NCC Group
Annual Report 2021

Plain-text annual report

Securing the future Peace of mind today and forever Annual report and accounts for the year ended 31 May 2021 We exist to make the world safer and more secure NCC Group is a global cyber and software resilience business operating across multiple sectors, geographies and technologies. As society’s dependence on the connected environment and the associated technologies increase, we use our global insights to help organisations assess, manage and develop their cyber resilience posture, enabling them to confidently take advantage of the opportunities that sustain their business growth. STRATEGIC REPORT Highlights 1 At a glance 2 Our investment case 4 Chair’s statement 6 Our strategic roadmap 8 9 Chief Executive Officer’s review 14 Our continued Covid-19 response 16 Markets 18 Research at NCC Group 20 Business model 29 Strategy and KPIs 32 40 49 Stakeholder engagement 53 Sustainability Chief Financial Officer’s review Principal risks and uncertainties GOVERNANCE 70 Chair’s introduction to governance 73 Governance framework 74 Board of Directors 76 Executive Committee 78 Board composition and division of responsibilities 87 Shareholder engagement 88 Audit Committee report 95 Nomination Committee report Cyber Security Committee report 98 100 Remuneration Committee report 119 Directors’ report 123 Directors’ responsibilities statement FINANCIAL STATEMENTS 125 Independent auditor’s report 133 Consolidated income statement 133 Consolidated statement of comprehensive (loss)/income 134 Consolidated balance sheet 135 Consolidated cash flow statement 136 Consolidated statement of changes in equity 137 Company balance sheet 138 Company cash flow statement 139 Company statement of changes in equity 140 Notes to the Financial Statements ADDITIONAL INFORMATION 187 Glossary of terms – Alternative Performance Measures (APMs) 189 Glossary of terms – other terms 191 Other information 192 Financial calendar Read more online: www.nccgroup.com Highlights 1 GAAP measures Revenue £270.5m . 7 3 6 2 . 5 0 7 2 . 7 0 5 2 . 0 3 3 2 . 3 5 1 2 Operating profit 2,3 £17.3m . 7 3 1 . 5 9 1 . ) 4 3 5 ( . 6 2 1 . 3 7 1 Basic EPS 2,3 3.6p 5 2 . 9 4 . . ) 4 0 2 ( 6 3 . 3 2 . 17 18 19 20 21 17 18 19 20 (restated) 3 21 17 18 19 20 (restated) 3 21 Alternative Performance Measures 2 Net cash/(debt) 2 £83.3m Adjusted operating profit 2, 3 £39.2m Adjusted EPS 2, 3 9.5p . 3 3 8 . 8 0 3 . 7 3 3 . 7 0 3 . 2 9 3 . 5 5 2 2 9 . 2 8 . 6 7 . 5 9 . 2 6 . . ) 8 7 2 ( . ) 2 0 2 ( ) 2 4 ( . . ) 7 3 4 ( 17 18 19 20 21 17 18 19 20 (restated) 3 21 17 18 19 20 (restated) 3 21 Footnotes 1 References for the Group’s results are for continuing operations. 2 3 See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items. Further information is also contained within the Chief Financial Officer’s Review and the Glossary of terms on pages 187 and 188. See Note 34 for an explanation of the prior year restatement recognised in relation to the adoption of the IFRIC agenda decision on cloud configuration and customisation costs in April 2021. The 2017 to 2019 figures above have not been restated. The following additional information and reconciliation is noted in relation to Adjusted operating profit due to the adoption of the IFRIC agenda decision: Adjusted operating profit (as noted above) Proforma amortisation charge in respect of certain cloud-based software arrangements (see explanation below) Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements 2021 £m 39.2 (3.0) 36.2 2020 £m 30.7 (1.4) 29.3 Change 27.7% (114.3%) 23.5% The proforma amortisation adjustment noted above represents an estimate of the amortisation that would have been recognised had the Group not changed its accounting policy in the current year following additional clarification on the accounting in relation to the configuration and customisation costs incurred in implementing Software-as-a-Service (SaaS) arrangements in the IFRIC agenda decision issued in April 2021. The proforma amortisation charge is estimated based on cloud configuration and customisation costs charged to the income statement in the year of £5.1m (2020: £7.9m). The Directors consider that Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements is comparable to Adjusted operating profit previously reported. Strong trading performance despite the pandemic Another year of excellent cash management Successful acquisition of IPM with strategic and financial importance Exciting development and growth of key service lines for the future Our cyber and resilience markets continue to offer excellent long-term growth prospects Investing for the future NCC Group plc — Annual report and accounts for the year ended 31 May 2021 1 Strategic reportAt a glance What we do NCC Group is a global cyber and software resilience business operating across multiple sectors, geographies and technologies. As society’s dependence on the connected environment and the associated technologies increase, we use our global insights to help organisations assess, manage and develop their cyber resilience posture, enabling them to confidently take advantage of the opportunities that sustain their business growth. This includes: Getting the basics of cyber hygiene correct Knowing what and how to prioritise Coping with the scarcity of skilled resources needed to deliver quality improvement, change and operations Responding to the increasing compliance, regulatory and legislative burden Quantifying cyber spend efficiency and return on investment Our divisions Across our two divisions, we deliver solutions that result in outcomes that match our customers’ goals, budgets and risk appetite, giving them peace of mind that their most important assets – their business, software and personal data – are safe and secure. Assurance Software Resilience We demystify cyber for our customers, and ensure: • Our customers understand the cyber threats and vulnerabilities across their technology environments, supply chains, processes and products • Our customers maintain their licence to do business, having achieved their governance, compliance and accreditation objectives in a changing regulatory environment • Our customers’ resilience against ever increasing cyber threats is materially improved because of implementing remediation plans and solutions • Our customers can reduce risk and achieve greater resilience for less investment • Our customers can outsource their cyber defence operations and increase their confidence in detecting and responding to cyber events We protect the development, supply and use of business-critical technology and software applications: • Our services ensure buyers are safeguarded from supplier failure, software vulnerabilities and unforeseen technology disruption • Our on-premise and cloud offering can demonstrate robust business continuity and risk mitigation, and suppliers benefit from enhanced credibility and intellectual property rights protection • Our escrow contract services secure the long-term availability of business-critical software data and applications • Our verification services assure customers that the knowledge and guidance are readily available to manage, maintain or recreate an application from the original source, should it ever be needed • Our cloud Escrow-as-a-Service (EaaS) offering helps customers transition to the cloud securely, so they can adopt the latest technology with confidence Read more on our markets on pages 16 and 17 Read more on our markets on pages 16 and 17 22 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Where we operate We operate as one global business, with in-country delivery tailored to local needs and cultures. We have a significant market presence in the UK, Europe and North America, and a rapidly growing footprint in Asia Pacific with offices in Australia, Japan and Singapore. Key: Our offices Group revenues Assurance revenue Software Resilience revenue UK and Asia Pacific £127.9m (2020: £124.7m) North America £90.0m (2020: £90.2m) Europe £52.6m (2020: £48.8m) £233.9m (2020: £226.2m) 65+ 73+ Global Professional Services £172.2m (2020: £166.2m) £36.6m (2020: £37.5m) Software Resilience contracts £24.0m (2020: £25.8m) Global Managed Services £56.2m (2020: £49.6m) Verification services £12.6m (2020: £11.7m) Products £5.6m (2020: £10.4m) Read more on our markets on pages 16 and 17 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 3 Strategic reportStrategic report24 + 3 + 0 + M 35 + M Our strong historical performance and enduring ability to succeed in a rapidly changing market are a result of four characteristics that will continue to fuel our growth now and in the future: Capex light Commitment to sustainability Research driven People centric Our investment case The global market for cyber professional and managed services offers phenomenal potential for growth, now and in the future. As investment in cyber resilience becomes essential to organisations’ licence to operate, NCC Group’s addressable market is expanding. Cyber security market size, 2018–2025 (USD billion) . 9 1 4 2 . 9 7 1 2 C A G R : 1 1 . 0 % . 3 9 5 1 . 5 3 4 1 . 3 6 9 1 . 9 6 7 1 . 3 9 2 1 . 5 6 1 1 18 19 20 21 22 23 24 25 Source: https://seekingalpha.com/article/4335822-check-point- software-market-misunderstands-subscription-growth. Our performance throughout the pandemic and beyond demonstrates our enduring and reliable business model in an agile market. We have grown revenue, gross margin and Adjusted operating profit 2 throughout a period of disruption. The performance of our key future service lines positions us to capture accelerating market growth. We have recurring high margin revenues and sustainable cash flows from our globally scalable Managed Detection and Response (MDR) and Software Resilience services, and a quality customer base. The acquisition of Iron Mountain’s Intellectual Property Management (IPM) business will be accretive to earnings per share (EPS). We expect revenue opportunities from offering a richer set of software verification and cloud and wider cyber resilience services to IPM’s extensive customer base over the medium term. +2.6% revenue growth +5.9% gross margin growth See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items. Further information is also contained within the Chief Financial Officer’s Review and the Glossary of terms on pages 187 and 188. 2 4 Our commitment to sustainability is integral to how we do business. Our approach to sustainability is focused on the recognised elements of environment, social and governance (ESG). They’re brought to life with our framework, which enables us to focus our efforts on the activities that deliver the greatest value to our people, our customers, our shareholders and the world we all live in. We will continue to secure the future today and our sustainability agenda will play a strategic role to support conscious decision making as we begin to set targets that challenge us to continually improve in making the world safer and more secure for all. We are research driven. Our greatest strength is our breadth and depth of world-class technical capabilities. We employ some of the most talented security consultants and researchers on the planet: every researcher on our team is also an active consultant. We consistently perform independent, cutting-edge security research that supports current and future specialist technical consulting capabilities and customer and consultant needs, and responds to world events. Through our agile methodologies, we have delivered six new solutions in response to market demand in the last year, including a next generation SaaS platform for digital escrow deposits and secured digital vault storage, data science-based analytical and machine learning approaches to threat detection, and our new data-driven cyber risk quantification and peer comparison offer. Read more on pages 53 to 68 Read more on pages 18 and 19 3,400 research days 6 new customer-facing propositions 35 tool releases We are people centric. Each day at NCC Group, our technologists and professionals wake up with one mission – to help make the world safer and more secure. Together they form a phenomenal knowledge network, collaborating, innovating and delivering value to our customers. We continue growing our technical people base year on year, even managing to increase our global headcount throughout the disruption of the global pandemic, because we invest in our colleagues’ wellbeing, career development and full potential. As we are taking advantage of remote and flexible delivery models, we have doubled our global resourcing days in 2020. This means that we truly put the best person on any job, all around the world. And we will seek to increase this even further as we grow our global talent pool and our colleagues’ skills and competencies and mature our global delivery model. We are capex light. Unlike other businesses in the technology space, we are an inherently asset-light business, limiting our capital expenditure and promoting our agility and flexibility to respond to changing circumstances. We have strengthened our Balance Sheet through disciplined cash management and reduced overheads which positions us to exploit further opportunities in the future. It has allowed us to invest up to £3m in cloud technology, artificial intelligence/machine learning advanced analytics, and our new remediation and security improvement offer. 8.1% growth in headcount +49 net movement in technical specialists 88.2% cash conversion ratio 2 £34.6m free cash flow Read more on page 50 Read more on pages 32 to 39 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 5 Strategic reportStrategic reportChair’s statement Securing the future As at year end, net cash (excluding lease liabilities 2) amounted to £83.3m including net placing proceeds of £70.2m; adjusting for this has meant that underlying cash amounted to £12.6m compared to net debt of £4.2m 12 months ago. It is also worth noting that we have taken no government subsidies or loans (other than deferring tax payments that have now been fully repaid), nor have we made any colleagues redundant or furloughed them during the pandemic, demonstrating our objective of being a global hub for cyber talent. In Assurance, the North American and EU Assurance businesses grew by 6.5% and 5.9% respectively on a local currency basis. Our UK and APAC business increased 3.9%, supported by growth in MDR and the launch of our Remediation service. Our Global Software Resilience business declined by 2.4%, a result of execution challenges in a remote environment and capacity challenges in sales resourcing. However, we are proud to see that our cloud proposition (EaaS) continues to go from strength to strength, with orders having increased by 83% to £2.2m, providing a promising and exciting platform for the future. Our business performance can be found in more detail on pages 9 to 13 Strategy and sustainable business model Our strategy, mission and vision remain unchanged, and continue to drive progress towards our medium-term objectives: • For our shareholders: • Double-digit revenue growth and margin improvement for Assurance • Return Software Resilience to sustainable growth • Disciplined cash generation • For our customers: • Use our unique data, capability and insight to help customers to meet their cyber resilience needs • For our people: • A global hub for cyber talent • An inclusive environment where everyone feels safe to be authentic and which is representative of the diversity of the world in which we live NCC Group’s research-driven, people-centric and capex-light business model enables us to remain at the forefront of the dynamic cyber industry. Further details on our strategy and value creation through our business model are provided on pages 29 to 31 and 20 and 21 respectively During the year, we agreed the acquisition and associated funding for Intellectual Property Management (IPM), the Software Resilience division of Iron Mountain, and received shareholder approval on 1 June. It was therefore pleasing post year end that we completed the transaction, which will be accretive to profitability and provide further strong cash generation. It is also pleasing that the management team has commenced the integration programme, and this is on plan. The strength and flexibility of our Balance Sheet will allow us to pursue further organic and inorganic growth opportunities where they align with our strategic and financial objectives. Further details on our recent acquisition are provided on page 12 Chris Stone Non-Executive Chair Our colleagues have continued to show their commitment and resilience throughout the pandemic in delivering excellent service to our customers and pursuing our mission, vision and objectives relentlessly. Introduction At the end of a financial year which has seen continued disruption to economies and trading environments worldwide, it is pleasing to be able to report to all our stakeholders that NCC Group has continued to demonstrate its resilience in many ways. In particular, NCC Group has achieved year on year revenue growth and profitability despite the headwinds of a global pandemic. Along the way, we secured the Group’s largest acquisition to date, enjoyed strong growth in our most exciting propositions for the future and, had another year of strong cash management. Business performance Overall, the Group delivered revenue growth of 2.6% (2020: 5.2%), Adjusted EBITDA 2 of £52.5m (2020: £45.5m) and Adjusted operating profit 2 of £39.2m (2020: restated £30.7m 3). On a statutory basis, after the partial recognition of acquisition costs of £7.6m and cloud configuration and customisation costs associated with the Group’s transformation programme SGT (£5.1m, 2020: restated £7.9m 3), operating profit increased by 37% to £17.3m (2020: restated £12.6m 3) and profit before taxation increased 54% to £14.8m giving rise to a statutory EPS of 3.6p (2020: restated 2.3p 3) and Adjusted basic EPS 2 of 9.5p (2020: restated 7.2p 2) respectively. The Group delivered sustainable cash flows with cash conversion 2 of 88.2%, resulting in the Group becoming cash positive in November 2020 prior to the equity funding process for the IPM business US acquisition. 6 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Dividend We are recommending an unchanged final dividend of 3.15p (2020: 3.15p) per ordinary share, making a total for the year of 4.65p (2020: 4.65p), with our dividend policy continuing to remain under review. The final dividend will be paid on 12 November 2021, subject to approval at the AGM on 4 November 2021, to shareholders on the register at the close of business on 15 October 2021. The ex-dividend date is 14 October 2021. Board composition There have been no changes to the Board during the year. Further details on our Board composition are provided on pages 78 to 86 Board governance and effectiveness As Chair, I am responsible for providing leadership to ensure that the Board operates effectively in all aspects of its performance. We have an established and experienced Board, which actively oversees the Group’s strategic development, monitors the delivery of its business objectives and considers risks and mitigating actions. Our performance and decisions made during this global pandemic are testament to the Board’s effectiveness. customers, an investor survey and shareholder engagement throughout the recent acquisition, and physical and mental wellbeing programmes for all our colleagues. Further details on stakeholder engagement are provided on pages 49 to 52 Colleagues We will always be a people-centric business and our technical colleagues are at the core of our customer offer, supported by agile sales and back-office functions. Our colleagues have continued to show their commitment and resilience throughout the pandemic in delivering excellent service to our customers and pursuing our mission, vision and objectives relentlessly. We seek to provide meaningful and rewarding career paths for all our colleagues. Following our colleague engagement survey, we will continue to create a great place to work and focus on becoming the employer of choice in our markets. We are also embracing more flexible ways of working and intend to continue with that flexibility as we anticipate returning to a hybrid office/remote way of working. In addition, through our colleague resource groups that create conversations inherent to an inclusive culture, we continue making NCC Group an organisation where everybody feels safe to be their authentic selves. Further information on risk management and the key risk identification procedures is set out on pages 40 to 48 Further details on this are provided on page 50 During the year, we have been further embedding the requirements of the UK Corporate Governance Code 2018 (the ‘Code’), particularly the renewed focus on identifying and engaging with all our stakeholders in a remote world. During the year we complied with all other aspects of the Code with the exceptions that our CEO and CFO pensions were not in alignment with our general colleague population, we do not have post-employment shareholding guidelines and we did not engage with the workforce to explain how executive remuneration aligns with the wider Company pay policy. The first of these three areas of non- compliance will be resolved following our 2021 AGM and subject to shareholder approval of our new Directors’ Remuneration Policy. We recognise that we still have much progress to make in terms of improving the diversity of the Board and our Executive Team (and indeed our workforce as a whole). With that in mind, during the year we have made the commitment that by 2024, we will have at least 33% female representation on our Board and at least one person of colour. Although this is best practice for FTSE 350 companies, we will commit to this target regardless of which share index we are in. Please see the Corporate Governance Statement starting on page 70 for further information Executive management composition It has been a delight to welcome Inge Bryan as Managing Director for NCC Group’s European Assurance operations, who joined us after a remarkable career in cyber and security. Inge previously held roles with the Dutch National Police and the General Intelligence and Security Service of the Netherlands and served as Home Affairs Counsellor in the Royal Netherlands Embassy in Paris. Before she joined NCC Group Inge was part of the cyber security leadership team with Deloitte Risk Advisory, securing the critical infrastructure of the Netherlands, including central government. In 2019 she was listed in the top 100 most influential women in the Netherlands and one of the 50 most inspiring women in tech. Further details on our executive management composition are provided on pages 76 and 77 Stakeholder engagement Successful stakeholder engagement is a key area of focus for NCC Group, especially during these remote and challenging times. During the year, we have engaged with our customers, our colleagues, our network and our shareholders. Certain highlights include the CyberUp Campaign, our “working together” approach with our On behalf of the Board, I therefore offer our sincere thanks and appreciation to all of the Group’s colleagues for their continued resilience and professionalism in delivering this performance. As a Board, we also welcome our new colleagues from the IPM business as we look to the future with enduring confidence. Sustainability NCC Group recognises the importance of an environment, social and governance (ESG) framework that underpins our operations as a key indicator of the Group’s sustainability and ethical impact. The Group has developed an ESG framework which continues to evolve. Examples of progress to date include the ongoing review of key policies and maintaining our corporate governance and decision-making structures through the “move to remote” during the pandemic. In addition, we continue to foster partnerships that support the development of future diverse cyber talent and we encourage engagement from colleagues and our external stakeholders around our four focus areas of gender, LGBTQIA+, race and ethnicity and neurodiversity. Further details on sustainability are provided on pages 53 to 68 Outlook • For the current financial year (FY22), the Board expects higher revenue growth partially offset by increased global costs from inflationary pressures as well as a resumption in travel and office usage • Our medium-term objectives continue to be double-digit revenue growth in Assurance and sustainable revenue growth in Software Resilience • We are recommending an unchanged final dividend of 3.15p (2020: 3.15p) per ordinary share Chris Stone Non-Executive Chair 14 September 2021 2 3 See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items. Further information is also contained within the Chief Financial Officer’s Review and the Glossary of terms on pages 187 and 188. See Note 34 for an explanation of the prior year restatement recognised in relation to the adoption of the IFRIC agenda decision on cloud configuration and customisation costs in April 2021. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 7 Strategic reportOur strategic roadmap Our connected society presents a world of opportunity It is essential for us all to proactively manage any risk to our safety and security. As you go about your daily routines you can be safe in the knowledge that we are passionate about keeping you and your personal data, the technology and devices you use, and the critical assets and software your business relies on safe and secure. It is our mission and is what drives our strategic roadmap... Mission Vision We exist to make the world safer and more secure. To be the leading cyber resilience provider globally. Trusted to protect and secure our customers’ critical assets. Sought after for our complete people-led, technology-enabled cyber and software resilience solutions that enable our customers to thrive. Delivering our vision through our Securing Growth Together transformation programme We continue to transform our business. Our vehicle for transforming the firm and achieving our vision is the Securing Growth Together programme, which is about connecting our global firm and creating stronger relationships with our customers. The programme is run through five workstreams: Lead the market Win business Deliver excellence Support growth Develop our people Read more in our Chief Financial Officer’s Review on pages 32 to 39 Delivering value to our customers Cyber threats are pervasive, complicated and rapidly changing and there’s no such thing as a “silver bullet”. We help our customers navigate through the complexity of cyber risks. Through our global research capability, technical expertise and full suite of services we can guide customers through the risks to achieve cyber resilience. Assess cyber risk Develop cyber maturity Manage cyber operation Read more in our business model on pages 20 and 21 Our Code of Ethics and values NCC Group is a distinctive place to work where we are guided by our Code of Ethics – treat everyone and everything with respect. Our common values help us to make decisions without the need for a comprehensive instruction manual: We work together We are brilliantly creative We embrace difference Read more on our sustainability on pages 53 to 68 8 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Chief Executive Officer’s review Resilience is the key Resilience is the key Covid-19, supply chain shocks and rampant ransomware attacks have reminded us all how difficult it is to predict the future and thus of the importance of resilience against unknown risks. We are proud of our own resilience through the past 12 months, demonstrating our ability to deliver great work, to hire more talent and to grow even through the most extreme of shocks. Our resilience starts with our people and I would like to pay tribute to the remarkable skills and commitment of my colleagues. They are at the heart of our success. Last financial year we hired over 200 front-line technical specialists, increasing our global net headcount by 8.1%. It is remarkable to think that many of them have not been into an office or met their colleagues. Happily, the feedback from surveys we have conducted indicates that the work we have done to onboard colleagues in the remote environment has been valued. Overall, the global voluntary attrition rate remained constant at c.15% and our technical attrition increased to 17.0% (2020: 14.4%). We identify two particular influences on this attrition increase. First, the advent of remote working drove significant labour mobility in the United States as it became possible to work for the largest and most exciting technology companies without having to move to the Bay Area. Second, while attrition was much lower in the UK and Europe through the first half, as the world began to open up we saw people leave to change lifestyle or gain variety after being locked down in the same place for an extended period of time. However, once again demonstrating our own resilience, the global operating and resourcing model that we developed mitigated the impact of this higher attrition, enabling us to deliver revenue in North America using resources spread elsewhere across the globe. Everyone is welcome There are not enough cyber skills in the world to meet today’s challenges. We see ourselves as playing a significant role in the attraction and training of new talent, having one of the cyber industry’s most effective training programmes. As we strive to bring more people into the world of cyber and to make the population of cyber specialists representative of the societies in which they live and work, we continue to focus on inclusion and improving the diversity of our teams. In particular: • We are embracing more flexible ways of working – and intend to continue with that flexibility as we explore new ways of working • Our four colleague resource groups – Gender, Race and Ethnicity, LGBTQIA+ and Neurodiversity – have catalysed conversations on topics as diverse as menopause, systemic racism, transvestism and autism, as we strive to raise awareness, create understanding and respect each other to make NCC Group an inclusive place for everyone • Our teams have worked hard to provide mutual support with a particular focus on mental health and wellbeing. We have 61 trained Mental Health First Aiders. Over 100 of our people managers have received training in mental health awareness, and a full wellbeing programme for colleagues is supplemented by employee assistance programmes in our local geographies. All of these efforts continue to help our teams through these difficult times and will provide a legacy of ongoing benefit in the future Adam Palser Chief Executive Officer Our resilience starts with our people and I would like to pay tribute to the remarkable skills and commitment of my colleagues. They are at the heart of our success. Which pandemic will you still be worrying more about next year? Pandemics start somewhere else and affect other people – until very suddenly they are on your doorstep and inside your business, forcing you to re-evaluate how you live and how you work. Our 2021 financial year was a tale of two pandemics, one biological and the other digital. The ensuing tug-of-war between these pandemics defined our markets: • Covid-19 rippled across our geographic operating territories at different speeds and intensities provoking different responses from governments. We saw demand from customers ebb and flow depending on whether their industry was opening up or being placed under more restrictions • Simultaneously, the rapid uptake of remote working drove increased cyber risk, which was exploited by “bad actors” including organised crime and state-sponsored groups. Ransomware, in particular, has now become so prevalent that no organisation can afford to ignore the risk it presents NCC Group plc — Annual report and accounts for the year ended 31 May 2021 9 Strategic reportStrategic reportChief Executive Officer’s review continued Sustainable growth for all of our stakeholders Every day we work for customers in pursuit of our mission: to make the world a safer and more secure place. This mission and the focus on our people are at the heart of our value proposition and how we do business. More broadly, our sustainability approach is focused on the recognised elements of environment, social and governance and our progress is outlined below: • Environment – Building on the new and successful ways of working created by the pandemic we are engaging in conversation with our customers to explore how we can work together to reduce the impact on the environment. In addition, as our office environments come back to life, we are investing in education programmes to reduce our physical impact – from flexible working and preventing unnecessary printing, to recycling. We have also developed our new working policies and therefore will continue to review our physical office requirements to ensure we only use what we need • Social – We continue to foster partnerships that support the development of future diverse cyber talent and encourage colleagues to give back to their local communities through schools, universities and charity partnerships, and the piloting of a giving back day in the UK. In addition, we continue to invest in developing not only our mental health first aid network and resources, but we are now looking to implement our broader wellbeing strategy, partnering again with This Can Happen. Through NCC Conversations we continue to encourage engagement from colleagues and our external stakeholders around our four focus areas of gender, LGBTQIA+, race and ethnicity and neurodiversity, adding accessibility in this coming year. These conversations alongside our performance management programme and career framework development help drive our performance culture, creating an environment where everyone is welcome and can be successful • Governance – We continue to strengthen our governance structures. We assess and consciously decide to work with customers who align with our own values and Code of Ethics. We are currently strengthening our Supplier Code of Conduct to ensure that we enter any supplier or partner relationship with a mutual understanding of each other’s code of ethics and general business policies. In addition, we remain committed to considering the interests of all our stakeholders when making decisions on the Group’s future strategy and priorities Year on year growth led by Assurance Against this backdrop, Group revenues increased by 2.6% (2020: 5.2%). On a constant currency basis 2, Group revenues increased by 3.6%. In our Assurance business, the North American and EU Assurance businesses grew by 6.5% and 5.9% respectively on a local currency basis 2. Our UK and APAC region increased 3.9%, including a notable 9.6% in the second half as industries began to look forward to the easing of restrictions. In our Software Resilience division, we were delighted by the 83% increase in Escrow-as-a-Service orders which herald great promise for the future, but disappointed by an overall revenue decline of 2.4%. Attracting sufficient sales resource, retaining sales colleagues, delivering on-site work and maintaining sales momentum have all been more difficult in a fully remote working environment and we anticipate improvements in all of these factors in the next 12 months as we work to return Software Resilience to sustainable growth. Gross profit increased by 5.9% to £110.6m (2020: £104.4m) with gross margin percentage increasing to 40.9% (2020: 39.6%). The margin increase was significantly driven by the flourishing of our global resourcing engine where skilled resources from every part of our Group can now be deployed on high value engagements, smoothing out peaks and troughs of demand or skill shortages. The gross margin was, however, offset by a c.£2m provision taken in relation to existing long-term European contracts as a result of pandemic disruption, cost increases and project management challenges. Operating profit increased by 37.3% to £17.3m (2020: restated £12.6m 3) after the inclusion of transaction costs of £7.6m in relation to the $220m acquisition of Intellectual Property Management (IPM), the Software Resilience division of Iron Mountain and cloud configuration and customisation costs associated with the Group’s SGT transformation programme (£5.1m, 2020: restated £7.9m 3). The Group manages its performance internally at an Adjusted operating profit 2, 3 level, with Adjusted operating profit 2, 3 increasing by 27.7% to £39.2m albeit with the benefit of a temporary reduction in travel and office usage costs of c.£3m. This information is disclosed below and reconciled to statutory operating profit. During the year, the Group has incurred £12.7m of Individually Significant Items (ISIs) (2020: restated £7.9m 3). These items relate to the acquisition of the IPM business (£7.6m) and cloud configuration and customisation costs associated with the Group’s SGT transformation programme (£5.1m, 2020: restated £7.9m 3). 2021 Assurance £m Software Resilience £m Central and head office £m Revenue Cost of sales Gross profit Gross margin % General administration expenses allocated Adjusted EBITDA 2 Depreciation and amortisation Adjusted operating profit 2, 3 Individually Significant Items Amortisation of acquired intangibles Share-based payments 233.9 (149.5) 84.4 36.1% (45.4) 39.0 (9.4) 29.6 – – – 36.6 (10.4) 26.2 71.6% (9.5) 16.7 (0.7) 16.0 – – – Operating profit 29.6 16.0 – – – – (3.2) (3.2) (3.2) (6.4) (12.7) (6.4) (2.8) (28.3) 10 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 2020 (restated) 3 Software Resilience £m Central and head office £m 37.5 (10.0) 27.5 73.3% (10.0) 17.5 (0.6) 16.9 – – – – – – – (5.0) (5.0) (3.5) (8.5) (7.9) (8.8) (1.4) Assurance £m 226.2 (149.3) 76.9 34.0% (43.9) 33.0 (10.7) 22.3 – – – Group £m 263.7 (159.3) 104.4 39.6% (58.9) 45.5 (14.8) 30.7 (7.9) (8.8) (1.4) 22.3 16.9 (26.6) 12.6 Group £m 270.5 (159.9) 110.6 40.9% (58.1) 52.5 (13.3) 39.2 (12.7) (6.4) (2.8) 17.3 Long-term market prospects are excellent Development of the connected environment Society’s dependence on the connected environment Agility and pace of the threat Regulatory environment The four secular growth drivers of resilience demands (as we refer to them) continue to strengthen: • The connected environment is growing. Every year, more devices are connected to the internet to share data or offer up the possibility of remote access, and the interdependencies between organisations across geographical boundaries increase in complexity too • Society’s reliance on the connected environment is greater than ever. The world is undergoing a digital transformation, accelerated by the pandemic. Our economies and wellbeing have never been more dependent on the safe and secure flow of data, and the continued resilience of essential services they rely on in their daily lives • The threat is growing. Ransomware has now become endemic • Regulatory and legislative requirements are increasing. In response to all of the above, organisations have to comply with a growing set of mandated requirements if they wish to enter or continue operating in their respective markets. This includes proposed legislation by the UK government for consumer IoT manufacturers, US President Biden implementing software supply chain security measures by Executive Order, and global financial regulators updating their rules and guidance on technology, third party technology and cloud outsourcing arrangements For further detail, please refer to the Chief Financial Officer’s review and Note 34 to the consolidated Financial Statements. Profit before taxation increased 54.2% to £14.8m (2020: restated £9.6m 3) and profit for the year increased 56.3% to £10.0m (2020: restated £6.4m 3) giving rise to a basic EPS of 3.6p (2020: restated 2.3p 3). Adjusted basic EPS 2 amounts to 9.5p (2020: restated 7.6p 3). In 2021, our cash conversion 2 was 88.2% (2020: restated 102.9% 3). Net cash/(debt) (including lease liabilities) 2 amounts to £48.9m (2020: net debt £42.4m). A sustainable business model in a dynamic environment We are fortunate to work in a sector of growing opportunity. Naturally, this opportunity attracts significant investment from many organisations leading to healthy competition for customers and talent. In this context, we cherish our research-driven, people-centric and capex-light business model that enables us to stay at the leading edge of the dynamic cyber resilience market and create profitable, cash generative growth. Every year we enable talented individuals from our global teams to research the latest technologies, discover new system vulnerabilities and develop skills. In turn: • The subsequent education of our customers and monetisation of our knowledge allow NCC Group to maintain its world-leading position in this ever-evolving market • The opportunity to work with some of the best minds in the industry and to conduct research is part of our rounded colleague value proposition for technical specialists Although the pandemic has impacted all our colleagues and customers around the world, our business has demonstrated its resilience and remains committed to securing the future for all. 2 3 See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items. Further information is also contained within the Chief Financial Officer’s Review and the Glossary of terms on pages 187 and 188. See Note 34 for an explanation of the prior year restatement recognised in relation to the adoption of the IFRIC agenda decision on cloud configuration and customisation costs in April 2021. The following additional information and reconciliation is noted in relation to Adjusted operating profit due to the adoption of the IFRIC agenda decision: Adjusted operating profit (as noted above) Proforma amortisation charge in respect of certain cloud-based software arrangements (see explanation below) Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements 2021 £m 39.2 (3.0) 36.2 2020 £m 30.7 (1.4) 29.3 Change 27.7% (114.3%) 23.5% The proforma amortisation adjustment noted above represents an estimate of the amortisation that would have been recognised had the Group not changed its accounting policy in the current year following additional clarification on the accounting in relation to the configuration and customisation costs incurred in implementing Software-as-a-Service (SaaS) arrangements in the IFRIC agenda decision issued in April 2021. The proforma amortisation charge is estimated based on cloud configuration and customisation costs charged to the income statement in the year of £5.1m (2020: £7.9m). The Directors consider that Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements is comparable to Adjusted operating profit previously reported. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 11 Strategic reportStrategic reportChief Executive Officer’s review continued Creating value through the execution of our strategy Over the past three years – and even through the disruption caused by Covid-19 – our confidence in the direction of our Company has grown. Our mission, vision and values have remained the same and we have created value through the relentless execution of our transformation programme, “Securing Growth Together”. Our mission is to make the world safer and more secure. Our vision is to be the leading cyber resilience provider globally, trusted to protect and secure our customers’ critical assets and sought after for our complete people-led, technology-enabled cyber resilience solutions that enable our customers to thrive. Our values are work together, be brilliantly creative and embrace difference. Our medium-term objectives are: • For our shareholders: • Medium-term target of double-digit revenue growth and margin improvement for Assurance • Return Software Resilience to sustainable growth • Disciplined cash generation • For our customers: • Use our unique data, capability and insight to help customers to meet their cyber resilience needs • For our people: • A global hub for cyber talent • An inclusive environment where everyone feels safe to be authentic and which is representative of the diversity of the world in which we live As noted at our interim results, we are now building on the strong initial foundations of our Securing Growth Together programme and have moved to the next phase of becoming the complete provider of global cyber resilience solutions, particularly by: • Broadening our portfolio (adding services and solutions across the cyber lifecycle) • Improving how we go to market globally (becoming easier to engage with and buy from) At our interim results, we announced the investment of £3m into propositions that we consider critical for the future and for realising our ambition to become a complete provider of cyber resilience services, acting as a one-stop shop to meet our customers’ demand for evidence-based solutions that offer them peace of mind. The table below describes these propositions and highlights our progress in FY21: Proposition Progress Escrow-as-a-Service (EaaS), our cloud escrow proposition • 83% increase in EaaS orders to £2.2m • Weighted year end EaaS pipeline at £1.1m • Notable FY21 wins include Sky, Carrefour, Christie’s, Deutsche Bank, Standard Chartered and Barclays Global Managed Services (GMS) • MDR revenue growth of 14.3% • Sales orders growth of 15.8% to £71.8m New MDR service based on Microsoft’s Azure Sentinel platform • Launched at the end of the financial year New Remediation service to develop clients’ resilience • Global rollout after successful UK launch (revenues of £2.1m with current pipeline of c.£3m) We will invest further in FY22 and beyond to build on these successes. Acquisition of IPM business The most significant investment of the year was our recent acquisition of the IPM business, which marked an exciting culmination of our financial year. We obtained shareholder approval on 1 June and completed the transaction on 7 June for $220m, subject to a normalised working capital adjustment during FY22. On this basis, the results of the IPM business will be consolidated from 1 June 2021. The acquisition was funded through an equity placing (£70.2m) in May combined with a new three year $70m term loan, existing cash balances and our revolving credit facility. The acquisition aligns with the Group’s existing strategy and will: • Scale up the Group’s core business to create a global business and platform for further growth • Generate revenue synergies through allowing the enlarged division to offer NCC Group’s broader suite of established verification services as well as the newer Escrow-as-a- Service (EaaS) cloud offering to the IPM business’ existing customer base • Present an exciting new opportunity to sell NCC Group’s cyber security services from its Assurance division into the IPM business’ broad and blue-chip customer base in the medium term • Be accretive to earnings per share from completion, even without factoring in revenue synergies • Result in greater strategic strength for the future Financially and, prior to our ownership, the business generated revenues of c.£23m and operating profit of c.£15m for the 12 months ended 31 December 2020, with cash conversion of c.90%. It is expected that for NCC Group’s FY22 financial year, the business will incur c.£2.5m of one-off integration costs. From an integration perspective, integration is on plan with all workstreams (People, Customers, Operations, Finance and IT) making good progress against objectives. The business is also supported by TSA and MSA arrangements. From a personal perspective, it has been a pleasure to welcome our new colleagues from the IPM business. I look forward with confidence to the future as we transform our Software Resilience business into a growing, high margin global leader. 12 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Summary Financial • Year on year growth in Group revenue, gross profit, Adjusted operating profit and profit before taxation • Another year of excellent cash management Operational • Successful acquisition of IPM with strategic and financial importance • Exciting development and growth of key service lines for the future • Market prospects continue to evolve and create opportunities • We continue to have a strong and flexible Balance Sheet that will allow us to fund future organic and inorganic growth Our FY22 operational priorities are: Assurance • Broadening our portfolio (adding services and solutions across the cyber lifecycle) • Growing recurring global MDR services • Effective use of our global resourcing model Software Resilience • Addressing execution challenges and returning Software Resilience to sustainable growth • Continuing to broaden the portfolio through innovation and growing our EaaS proposition • Embedding the IPM acquisition and minimising integration costs Outlook • For the current financial year (FY22), the Board expects higher revenue growth as compared to FY21 partially offset by increased global costs from inflationary pressures as well as a resumption in travel and office usage. IPM integration costs are expected to be c.£2.5m • Our medium-term objectives continue to be double-digit revenue growth in Assurance and sustainable revenue growth in Software Resilience • Q1 FY22 revenue growth was stronger than prior year in local currency but we experienced some un-anticipated disruption in customer buying patterns over the summer period. Q1 orders were ahead YoY and our orders pipeline is robust. Consequently, the full year outturn remains in line with management expectations • The Board is recommending an unchanged final dividend of 3.15p (2020: 3.15p) per ordinary share Adam Palser Chief Executive Officer 14 September 2021 S t r a t e g c i r e p o r t Read more online: www.nccgroup.com 13 Strategic reportStrategic report Our continued Covid-19 response Planning ahead to survive and thrive in a global pandemic When the World Health Organization announced the global pandemic, we began planning to support our colleagues and our customers through the inevitable lockdown. The priority was colleague welfare and customer safety. Beyond that, we set out two clear objectives that would guide our actions: • Maintain a strong Balance Sheet to ensure the survival of the Company and its ability to pounce on opportunities as the pandemic subsided • Maintain the capacity and capability we knew we would need to meet future demand We worked towards these objectives using five strategic pillars. Anticipate Be resilient Objective: Plan for different outcomes and track KPIs to inform our decision making Objective: Ensure the safety of our colleagues and customers, and maintain continuous operations Examples of our actions: Examples of our actions: • Scenario planning • Preparation for contingency plans with different levels of response • Data-led insights from our new systems • Regular communication • Global systems set up to ensure colleagues delivering customer work were supported to do this remotely • Developed a programme that enabled critical need colleagues to access office environments when it was safe and permitted to do so • Provided colleagues with resources to support longer-term remote working 14 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 S t r a t e g c i r e p o r t Stay profitable Exploit any downtime Prepare for the bounce back Objective: Proactively sell remote services; careful control of cost and cash Examples of our actions: • More than 95% of our services can be delivered remotely • Provided advice and guidance to customers with practical solutions to stay safe during the global pandemic • Continued to develop our service offerings to support customers with short-term challenges caused by the pandemic as well as through our research capability and global threat intelligence insights, continuing to develop solutions for the future Objective: Strengthen the firm every day through research and development Examples of our actions: • Invested a record 3,400 days on technical security research, which resulted in a significant contribution of conference presentations, vulnerability advisories, blog posts, research papers and open-source tools being released • Created a new internal research working group focused specifically on finding creative and massively scalable solutions to remediate (even prevent) security vulnerabilities at internet scale, and a group which focuses exclusively on the security implications of emerging technologies yet unstudied by any other security research firm Read more on our research on pages 18 and 19 • Developed our Global Assurance operating model, investing in our future delivery capability and value proposition Objective: Preserve capability and capacity to invest selectively for the future Examples of our actions: • Acquisition of Iron Mountain’s Intellectual Property Management (IPM) business to provide a robust platform for growth, particularly in North America but also for our Software Resilience division and NCC Group as a whole • Redesigned and launched our regional websites, which supports our new global marketing operating model • Reimagined our future world of work by learning from and listening to the experience of the pandemic including how flexible working could be an enabler for a more inclusive and diverse workforce • Continued investment and development in services and solutions to broaden our portfolio and better serve our customers including the launch of our new Remediate service and our flagship Partner Network for our Software Resilience offering in the UK NCC Group plc — Annual report and accounts for the year ended 31 May 2021 15 Strategic reportStrategic report Markets Market dynamics A changing threat landscape and exponential digital transformation, coupled with society’s ever-growing reliance on digital technologies and increasing regulatory and legislative requirements, mean that investment in cyber and software resilience is no longer optional and NCC Group’s addressable market is growing. Changing threat landscape Exponential digital transformation Society’s ever-growing reliance on digital technologies Increasing regulatory and legislative requirements A changing threat landscape The global geo-political environment fuels a buoyant cyber resilience market. Strategic competition is coming from China, and hostile threats from Russia, Iran and North Korea. This, coupled with emerging offensive capabilities in other nation states and organised crime groups, creates a volatile state of unpeace that organisations need to prepare for, navigate and defend against. As the scourge of ransomware emerges as a distinct threat to organisations of all sizes, and software supply chain attacks inflict mass disruption in all geographies, the real-world kinetic impact of recent cyber attacks has catapulted a deeper awareness of the threat to our digital lives into the mainstream. Society’s ever-growing reliance on digital technologies This has been exacerbated by exponential digital transformation. Software and cloud consumption, driven by the Internet of Things (IoT), has never been higher, and the digital supply chains upon which our connected environment depends have never been more complex and interdependent. And as the fall-out from ransomware attacks and technical outages alike has shown, we have never relied more on the smooth functioning of digital technologies than we do now. Increasing regulatory and legislative requirements That means, too, that focus on and expectations of ensuring the continuity of essential services – and with it a renewed awareness of the crucial importance of digital business continuity planning – have increased significantly. And while citizens rightly expect organisations to act responsibly, so legislators and regulators have concluded that the defence and resilience of schools and hospitals, banks and insurers, water treatment facilities and gas pipelines are too important to be left to chance. As a result, we are seeing a global increase in the depth and breadth of mandated requirements with which organisations must comply to enter or continue operating in their respective markets. Cyber resilience measures are becoming an integral element of an organisation’s licence to operate. We are seeing evidence of this in the UK with the government’s proposed legislation for consumer IoT manufacturers, and the strengthening of security requirements for telecommunications companies. In the US, the government is taking forward software supply chain security measures by Executive Order and the Australian government is enhancing incident management for critical infrastructure operators, while the European Union is pressing ahead with expanding the scope of the Network and Information Security Directive. At the same time, we are seeing a growing convergence of cyber and software resilience as part of a broader trend towards digital operational resilience. Global financial regulators, from the Basel Committee to the UK’s Prudential Regulation Authority and Canada’s Office of the Superintendent of Financial Institutions, have updated their rules and guidance on technology, third party technology and cloud outsourcing arrangements. All acknowledge that the financial systems’ reliance on third party solutions presents risks that need to be mitigated before they fundamentally threaten the global financial system. 16 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Although competition for customers and talent is also growing, our continued portfolio evolution and differentiation enable us to take advantage of the tremendous opportunities the cyber services market offers, fuelling our growth now and in the future. Growing competition for customers and talent Continued portfolio evolution and differentiation Competition for customers As board-level and senior executive understanding – and liability – grows, cyber and software resilience is increasingly seen as a strategic investment. That also means that the competitive landscape continues to be busy on all fronts, and that new and disruptive ways of working and service delivery come to market frequently. Excitement about new and emerging technologies – from artificial intelligence to quantum computing – that infuse traditional cyber offerings continues unabated. By way of example, venture capital activity until May 2021 rivalled the full-year activity level in 2020 and continues on an upward trajectory, and private equity investment continues to focus on the typical “platform buy and bolt on” strategies across cyber services and technology domains globally. We’ve also seen continued evolution in penetration testing to continuous, automated and on-demand/crowd-sourced models and experienced competitive pressures in the Managed Detection and Response space, and from regionally and vertically aligned specialists in the wider Software Resilience offering. Competition for talent In addition, competition for talent continues unabated, not least as regulatory authorities are equally seeking to fill their capability gaps as they discharge their new responsibilities. As the global pandemic has driven remote working models more widely, we have, moreover, experienced external challenges to our traditionally uncontested talent pools, for example, where US technology companies have acquired talent in the European and Asia Pacific regions. NCC Group’s continued portfolio evolution and differentiation Through our combined Cyber and Software Resilience offering, we are uniquely placed to offer our customers – current and new – easy-to-access peace of mind in an ever-more complex digital world. Our service orientated research and development, and selective investments to meet our customers’ changing challenges and demands have and will allow us to: • Evolve our penetration testing services to address risks of commoditisation • Establish our Managed Detection and Response offering as a leading proposition in a competitive and diverse space, building on a full suite of incident response and threat intelligence services across a leading, sovereign European business, while adding analytical and machine learning approaches to our threat detection, to offer customers insight and context into malicious activity and response capabilities to identify and mitigate sophisticated cyber threats • Innovate to integrate Microsoft Sentinel into our offering which means we are fully equipped to manage threat monitoring and detection for Microsoft customers • Differentiate our Remediate service against competition from system integrators, generalist consultancies and fragmented boutiques, through our technical depth, expertise, scale and global footprint which mean we are able to work with our customers to assess their existing risk position, and prioritise and fix security weaknesses as part of a structured improvement plan to reduce their cyber risk • Enhance our Software Resilience capabilities into a market- leading combination of service modernisation and trusted reputation, through the acquisition of Iron Mountain’s Intellectual Property Management (IPM) business, which completed on 7 June 2021, and the continued innovation in cloud-delivered services and a next generation Software-as-a-Service platform for digital escrow deposits and secure digital vault storage Finally, our tenure, stability and reputation mean we remain an attractive destination for global talent at all stages of their career and we continue to invest in creating a world-class environment in which everybody is welcome and can be successful. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 17 Strategic reportStrategic reportINSIGHTS: RESEARCH AT NCC GROUP Cutting-edge research and technical capabilities NCC Group employs some of the most talented security consultants and researchers on the planet, serving customers worldwide and uncovering countless vulnerabilities per year through both customer work and independent vulnerability research. We are a research-driven firm where every researcher on our team is also an active consultant. Our greatest strength is our breadth and depth of world-class technical capabilities, publicly exemplified by our research publications, now spanning into the hundreds per year, across two decades 1. We consistently perform independent, cutting-edge security research across hardware and embedded systems security, applied cryptography, programming languages, artificial intelligence and machine learning, mobile privacy, cloud and container security, exploit development, critical infrastructure security and threat intelligence, and beyond all technologies, and in all sectors – the outputs of which support current and future specialist technical consulting capabilities and customer and consultant needs, and respond to world events. We host a GitHub repository of over 200 open-source security tools 2 , have a research group dedicated to security research in the public interest 3 , and are trusted experts to whom open-source projects and major tech companies alike regularly turn for our publicly reported security audits of their most important technologies 4. Public-facing reports, research papers and tool releases are published on our dedicated research blog, research.nccgroup.com, and are also regularly covered by publications including the Wall Street Journal, New York Times, Washington Post, DarkReading and Politico, as well as other mainstream and trade publications globally. Our research blog attracted over a quarter of a million visitors in the past financial year. We also regularly work with independent UK consumer body Which? undertaking research across a range of smart devices – from toys to doorbells. The results are published in its online and print magazine titles as well as extensively covered by the mainstream media with our more detailed research findings published on our blog. In addition to our published work, our researchers regularly present their work in top research venues across as the world as well as serving on review boards of conferences. These include Black Hat USA, Chaos Communication Congress, HITB Amsterdam, CanSecWest and DEF CON to name a few. Our technical capabilities extend beyond our public-facing work, to include our internal-only research and development function, including our Exploit Development Group, Threat Intelligence Fusion Centre and Full Spectrum Attack Simulation Group as well as unpublished proprietary tooling. FY21 research Our research investment has had a direct and positive impact on the safety and security of our digital world for everyone, from operators of critical infrastructure to everyday consumers. We discover and remediate existing vulnerabilities before they can be uncovered and exploited by threat actors. We continue to invest in our future – both as a firm, and in improving the security of the global internet ecosystem. In January 2021, we published our inaugural Annual Research Report, in which we summarised our security research findings from across all our conference publications, blog posts and tool releases published by researchers at NCC Group between 1 January and 31 December 2020. In this report, we presented our findings and their impact in context, with links to the associated research papers, recorded conference presentations, publicly reported security audits, technical advisories and open-source tools, as well as selected media coverage of our work 5. 51 conference presentations, including over 20 presentations at “Tier 1” research venues 9 internal research working groups 8 whitepapers, research papers and research reports 35 open-source tool releases 71 research blog posts 37+ technical advisories/CVEs 18 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Jennifer Fernick SVP & Global Head of Research Highlights include: • We invested a record 3,400 days on technical security research, which resulted in a significant contribution of conference presentations, vulnerability advisories, blog posts, research papers and open-source tools being released 3,400 days dedicated to research • We co-founded the Open Source Security Foundation 5 – a group of industry experts working together to improve the security of the open-source ecosystem – forming the group’s governing board alongside representatives from GitHub, Google, IBM, JPMorgan Chase, Microsoft, OWASP Foundation and Red Hat, among others • We served on the Industry Advisory Board at King’s College London, the Executive Steering Board for the Internet of Things Security Foundation (IoTSF), the UK’s National Cyber Security Centre (NCSC) Research Advisory Panel and the Technical Advisory Council of the Open Source Security Foundation, as well as contributing to standards groups like the CIS Benchmarks, the ioXt Alliance and the C Standards Committee • We created a new internal research working group focusing specifically on finding creative and massively scalable solutions to remediate – and perhaps even prevent – security vulnerabilities at internet scale, as well as a group which focuses exclusively on the security implications of emerging technologies yet unstudied by any other security research firm • It’s this technical excellence that makes NCC Group attractive to some of the world’s most talented security consultants. Attractive to those just starting out in their career, and to those who have already established a name for themselves in the infosec community, there is a research path for every single consultant who wants it here at NCC Group Research at NCC Group typically falls under one or more of six core categories: Offensive – we perform deep technical vulnerability research to understand the complexities involved in attacking different technologies and systems and the true impact of any successes that attackers might derive with similar capabilities. Defensive – outputs from our offensive research inform our defensive research – this is where we research methods, tooling and solutions to mitigate the issues that we identify across technologies. Capability – we are constantly innovating and developing new technical testing capabilities and methodologies to keep pace with the rapid change in technology and threat landscapes. This ensures that when we assess client systems and networks, our techniques are at least as good as those of their adversaries. Future looking/horizon scanning – we routinely research emerging technologies to understand the potential security impact of those technologies on the sectors in which our customers operate. Customer-driven commercial research – we regularly perform paid research for customers, helping them to answer any uncertainties they might have on technology risk, such as understanding security capabilities of specific technologies or emerging technological security impact on an industry or sector. Collaborative – we are open to research collaborations and regularly work with academia through joint research and PhD sponsorships. We also contribute many of our research outputs to various international security standards bodies and we are open to B2B and consortia-based research collaborations. https://research.nccgroup.com/2020/08/21/immortalising-20-years-of-epic-research/. 1 2 https://github.com/nccgroup. 3 https://research.nccgroup.com/2021/01/31/2020-annual-research-report/ #PublicInterestTechnology. 4 https://research.nccgroup.com/category/public-report/. 5 https://newsroom.nccgroup.com/news/ncc-group-joins-forces-with-industry- leaders-to-improve-security-of-open-source-software-oss-408150. https://research.nccgroup.com @NCCGroupInfoSec NCC Group plc — Annual report and accounts for the year ended 31 May 2021 19 Strategic reportStrategic reportBusiness model Creating value We draw on our expertise, capabilities and global footprint to develop solutions to meet current and future cyber challenges. We help to educate policymakers and regulators. We give back to protect our local community services. And we share opportunities to experience the world of cyber and inspire the next generation to secure our future. A K Assurance How we create value S S E S S CYBER RIS 33+ D E V E L O P C Y B Software Resilience M A N A G E TION ER M R+D ITY A C R E Y B P R U A T E O R 33+ Research and development investment We continue to innovate and develop new technical testing capabilities to keep pace with the rapid change in technology and threat landscapes. Our ongoing research allows us to understand and quantify risk for our customers about the technologies they use and the threats to the sectors and industries in which they operate. Read more on pages 18 and 19 Inputs Securing Growth Together strategy • In a fast-moving and complex environment our enduring strategy enables us to be agile to continue to make sustainable investments, creating the world’s leading cyber and software resilience, risk mitigation and remediation specialist Talented and motivated colleagues • We are a global community of talented individuals working together, being brilliantly creative and embracing difference to help make the world safer and more secure Culture of innovation • Research driven where every researcher is also an active consultant. We invest in sustainable product development, continually enhancing our proposition to meet current and future needs of customers Stronger partner relationships • We are active members of the global cyber and software resilience community, working in collaboration and in partnership with key industry players. Many successful global partnerships have delivered integrated, seamless solutions to customers Market-leading reputation • We understand our customers’ challenges and the risks these pose to their business. Successful delivery to customers worldwide means we are in a strong position to help them understand and improve their cyber resilience posture and how best to mitigate against evolving threats, keeping them up to date and aligned to regulations and compliance needs throughout 20 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 34 + 33 + I I 34 + 33 + I How we create value Read more on our strategy on pages 29 to 31 S t r a t e g c i r e p o r t Value creation Colleagues • Our core strength is the expertise of our colleagues and we aim to create an environment where everyone can reach their full potential. From our technical teams to our professional teams, we work together in support of our customers. Colleagues are part of a phenomenal knowledge network, connected through online collaboration and communication platforms with access to formal and on the job learning opportunities Customers • The cyber landscape is complex, and our unrivalled global footprint, technical community and scientific approach mean we can confidently say: we understand it, we are good at it and we can help mitigate the risks • We advise on the right solution to match our customers’ cyber and software resilience posture requirements – based on goals, budgets and risk appetite • We balance our global knowledge with customer-specific prioritisation of risks to ensure the right actions are taken to mitigate them Our network • We are active members of the cyber and software resilience community, working in collaboration and partnership with key industry players around the world. Our network extends to ensuring we have the relevant accreditations and certifications to assure our customers of our professional services. This includes our partner programme Shareholders • Our scale provides us insights and understanding of the vulnerability landscape and our technical teams and tools allow us to provide insight into the patterns of vulnerability. This, along with our people-led culture, gives us a competitive advantage and superior shareholder value 33+ 33+ 33+ 33+ 33+ Assurance As one of the world’s leading cyber security service providers we are best placed to help businesses assess, develop and manage the cyber security risks they face. Through an unrivalled suite of services, we provide organisations with peace of mind that their most important assets are protected. Software Resilience Regardless of whether the infrastructure or data is on-premise or in the cloud, security and regulatory compliance of business-critical technology need to be assured. Through our data and application continuity solutions we safeguard buyers from supplier failure, software vulnerabilities and unforeseen technology disruption while providing credibility and intellectual property rights protection for software suppliers. Assess cyber risk A fast and global response with the ability to understand what the problem is, using experience and/or relevant industry frameworks. The value is not just in the assessment but in the clear advice and guidance from the results to improve cyber resilience. Read more on pages 22 and 23 Develop cyber maturity We work together with our customers to help them develop security capability or fix the issues identified during the assess stage. It is only once these areas have been remediated that the true return on investment will be realised against their cyber spend. Read more on pages 24 and 25 Manage cyber operation The ever-evolving threat landscape means that beyond the initial assess and develop phases it is vital to continually improve levels of security, detect incidents and react to them. We help companies manage their own capability or provide it through efficient security managed services. Read more on page 28 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 21 Strategic report34 + 33 + I I 34 + 33 + I I 34 + 33 + I I 34 + 33 + I I 34 + 33 + I I BUSINESS MODEL INSIGHTS: ASSESS CYBER RISK 33+ Making the automotive sector safer and more secure The key priority for the automotive industry has for many years been safety – the safety of vehicle occupants, other road users and pedestrians, by trying to prevent crashes from occurring and minimising injury when a crash does occur. Established international standards and regulations are in place to support this initiative. However, as connectivity and automation have increased (and are still increasing at pace), the safety challenge has now been joined by a cyber security challenge, resulting in a concept of cyber safety. Many modern vehicles have Advanced Driver Assistance Systems (ADAS), such as Adaptive Cruise Control and Lane Keep Assist, that require software to automatically control physical aspects of the vehicle, e.g. steering, braking and acceleration. These systems have primarily been designed to increase safety; however, as thousands of lines of complex code are controlling these vehicle functions, cyber security flaws could result in catastrophic outcomes and, therefore, cyber security and functional safety have become closely coupled. Regulatory compliance Automotive cyber security standards are being developed to support the industry and regulations have been recently introduced. These will ensure that the vehicle manufacturers and their suppliers don’t just consider cyber security as a checklist item during their production phase, but instead embed cyber security into their entire vehicle design and development lifecycle, making fundamental cultural changes to the way vehicles are created. Cyber security and functional safety have become closely coupled. Cyber security basics and the prioritisation of cyber activities The diverse nature of the automotive industry – from small electric vehicle start-ups to huge multinational manufacturing groups and many other shapes and sizes of organisation in between – means that cyber security has had different priorities in different companies historically. This is especially due to the tight margins within the sector. A recent industry report 6 highlighted that 30% of car manufacturers and suppliers do not have an established product cyber security programme or team. Therefore, the automotive industry is facing a steep learning curve and will require significant assistance from the cyber security community. Resourcing challenges and return on cyber investment As in many other industries, the automotive sector faces serious cyber security resourcing challenges. In an article 7, our CTO, Ollie Whitehouse, highlighted the shortage of cyber resilience skills, explaining that from our own research, of those who planned to outsource elements of their cyber security in the next 12 months, 43% said that this was being driven by return on investment. This suggests that organisations recognise the importance of validating cyber security spend, but they are not confident that they have the skills or resources to do so in house. How we are helping the automotive industry tackle these challenges The NCC Group Transport practice has been part of the independent review process validating new automotive cyber security standards and has aligned our services (in some cases, developing new ones) to help support vehicle manufacturers to achieve compliance with the new regulations, as the most serious consequence of non-compliance is the inability to sell new vehicles. The services involve close collaboration between our governance, risk and compliance teams and deeply technical cyber security experts with automotive industry-specific knowledge and expertise. Our services help vehicle manufacturers to address some fundamental cyber security challenges, not just to achieve initial compliance with the regulations, but to maintain that compliance by changing cyber security culture. As advisory partners to our customers, we will continue to help them increase their cyber security maturity by providing expert advice, security assurance and software resilience, which over time is expected to become a market differentiator within the automotive industry. 6 7 Securing the Modern Vehicle: A Study of Automotive Industry Cybersecurity Practices – Ponemon Institute https://www.mynewsdesk.com/nccgroup/blog_posts/technical-viewpoint-cyber- resilience-skills-please-mind-the-gap-101288. 22 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 34 + 33 + I I Regulatory compliance driving automotive industry investment in cyber security * e z s i t e k r a m r e b y c e v i t o m o t u A n b $ $9 $8 $7 $6 $5 $4 $3 $2 $1 $0 0.6 2.0 2.4 1.0 3.9 3.5 2020 2021 2022 2023 2024 2025 Cyber security hardware Cyber security software Cyber security processes Key NCC Group services: Risk management Remediate SDLC Pentesting Vehicle SOC UNECE cyber security regulation adopted January 2021 Supporting international standard published Q3 2021 New vehicle types with over-the-air software updates must be certified July 2022 New vehicle types without over-the-air software updates must be certified July 2024 All new registrations with over-the-air software updates must be certified July 2024 All new registrations without over-the-air software updates must be certified April 2026 Japan and Europe Japan Japan and Europe Japan Preparation for certification Certification deadlines * Source: https://www.mckinsey.com/industries/automotive-and-assembly/our-insights/cybersecurity-in-automotive-mastering-the-challenge. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 23 Strategic reportStrategic report BUSINESS MODEL INSIGHTS: DEVELOP CYBER MATURITY 33+ Building resilience within local government A ransomware attack on a UK local government authority in early 2020, which significantly disrupted its ability to maintain operations, brought into sharp focus the risk posed by cyber criminals and other malicious actors. This event raised concerns that comparable organisations within the public sector may also be similarly vulnerable and the importance of maintaining citizen services and operational resilience. In response a central government sponsored 14-week remediation programme was initiated to rapidly establish the risk position in 28 organisations thought to be at the greatest risk of ransomware, and to make practical interventions to reduce the specific risks identified. The objectives were: • Reduce vulnerability of backups to ransomware attack • Reduce the susceptibility of organisations to ransomware attacks • Improve the longer-term resilience of each organisation An initial view of the risk in key areas was established through a targeted questionnaire and workshops, with a programme of accelerated security improvement and remediation work initiated to quickly reduce risk across all organisations. A collaborative approach The pace of the programme required a high degree of integration and collaboration across the broad stakeholder group, working with multiple independent organisations each with different priorities. The joint programme between the local authorities, Ministry of Housing, Communities and Local Government, Cabinet Office and our team of NCC Group experts coupled with the broader stakeholders required a highly transparent and flexible operating model to succeed. A baseline of vulnerability exposure and security posture was established through a facilitated, self-assessment approach via a workshop. This provided an indication of the risk present in each estate; however, in most cases, a cyber threat actor emulation was required to truly understand security posture. The delivery of risk prioritised remediation at this scale was only achievable through a modular approach that delivered essential solutions to the organisations that needed them. The modules are continually updated based on the latest technology and threat information and cover key security and resilience themes. This approach allowed consistency of delivery at scale for common risks, while enabling a more flexible approach to unique risks where required. Outcomes The programme quantifiably reduced the risk of the ransomware threat across many organisations critical to the UK government’s Covid-19 response: • All critical and high risks identified in relation to both the vulnerability of backups to ransomware and the broader susceptibility to ransomware were reduced to a controllable level • All organisations received a long-term security improvement plan detailing residual risk and recommendations for continuous improvement • 221 remediation modules were delivered across all organisations using multi-disciplinary teams of cyber consultants and engineers 24 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 34 + 33 + I I Achieving sustainable cyber security resilience What needs to be in place? • The desire to tackle deep-seated challenges • Understanding the technology is vital rather than simply executing compliance • The importance of long-term improvement programmes • A minimum cyber resilience criteria to support investment The scale and criticality of the cyber security challenges we all face can only be tackled through a collaborative approach that embraces diverse teams and perspectives across the public and private sectors. It’s not easy, but the benefits in understanding and reducing risk are significant. Pete Cooper Deputy Director Cyber Defence in the UK Cabinet Office NCC Group plc — Annual report and accounts for the year ended 31 May 2021 25 Strategic reportStrategic reportBUSINESS MODEL INSIGHTS: DEVELOP “RESILIENCE BY DESIGN” 33+ Promoting safe and secure cloud adoption worldwide The last year has seen intensified global dialogue on the challenges facing regulatory authorities around the world, to update guidance, rules and frameworks on third party and technology risk management and operational resilience in the face of accelerated cloud and technology adoption, particularly in financial services. Third party software has become a permanent fixture of many competitive organisations’ supply chains: according to the Bank of England, 40 to 90% of banks’ workloads globally could be hosted on public cloud or Software-as-a-Service within a decade. We have been delving into the topic of operational resilience and third party risk management within financial institutions (FIs), exploring what the latest guidelines and proposals released by regulators across the globe mean for businesses, their resilience, and the pace of digital transformation across the sector. As reliance on third party software and its availability continues to increase, financial institutions must ensure that all providers they work with have the necessary risk mitigation and business continuity measures in place. Taking action • Organisations should assess the resilience of their supply chain, categorising outsourcers on their criticality, financial stability and concentration risk, with particular attention paid to services in the cloud • Once this is understood, businesses can put the appropriate strategies and systems in place to manage risk. Organisations should look for suppliers that proactively deliver complementary risk mitigation and business continuity assurance that fit with the organisation’s needs. This can include implementing robust onboarding and procurement policies that ensure that software escrow agreements and verification testing are built into any supplier contracts • For every outsourcing agreement, organisations are required to develop a business continuity plan in order to protect business-critical applications. This can be tested repeatedly using software escrow verification tests, which ensure that an application can be rebuilt should the need arise • For many financial institutions and their outsourcers, these regulatory changes could mean that a lot of resource must be used on the creation and implementation of viable stressed exit plans. However, for those with escrow agreements already in place, organisations can test their existing procedures and cover anything that has been missed NCC Group has long taken the view that software, technology and data escrow solutions offer legal and technical assurance to allow firms to adopt, innovate and manage third party technologies with confidence. We continue to engage with regulators worldwide to encourage them to acknowledge escrow agreements as a mechanism that enables organisations to comply with third party risk mitigation, outsourcing and business continuity requirements and as a way to operate and grow in a resilient, safe and secure way. We believe that awareness and education of operational resilience need to improve and that regulators can play a role in supporting financial institutions in achieving resilience by design. Simon Fieldhouse Global Managing Director, Software Resilience 26 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 34 + 33 + I I Overview of the financial regulatory authorities publishing consultations, supervisory statements and update guidance on operational resilience and third-party risk management over the past 12 months. Canada Office of the Superintendent of Financial Institutions (OSFI) Technology Risk Consultation United Kingdom Prudential Regulation Authority (PRA) Supervisory Statement SS2/21 on Outsourcing and Third Party Risk Management European Union Digital Operational Resilience Act Ireland Central Bank of Ireland Consultation on Cross Industry Guidance on Operational Resilience United States Proposed Interagency Guidance on Third-Party Relationships: Risk Management Financial Stability Board Discussion Paper on Outsourcing and Third Party Relationships Dubai Dubai Financial Services Authority Guidelines for Financial Institutions Adopting Enabling Technologies Singapore Monetary Authority of Singapore (MAS) Technology Risk Management Guidelines NCC Group plc — Annual report and accounts for the year ended 31 May 2021 27 Strategic reportStrategic reportMANAGE CYBER OPERATION I BUSINESS MODEL INSIGHTS: 33+ Protecting critical research and education The ever-evolving threat landscape means that beyond the initial assess and develop phases it is vital to continually improve levels of security, detect incidents and react to them. We were engaged by a university to design a comprehensive package, including a broad, ongoing Managed Detection and Response (MDR) solution. From our previous experience in the higher education sector, we knew that securing universities from cyber threat can be more complex than in other sectors. Liberal expectations of information sharing from the student body need to be balanced with the requirement to protect extremely valuable intellectual property. A nuanced and segmented approach to risk is required. Additionally, any solution had to work for both on-premise and cloud architectures. The starting point was to understand the enterprise deployment in a way that was digestible by the customer’s security team. From this baseline, the priority was to implement a solution to identify malicious activity at the earliest point to accurately report incidents so that effective remediation could be conducted. The NCC Group technical team designed a multi-layered solution, including a Managed Detection and Response (MDR) suite incorporating Security Information and Event Management, endpoint detection and network detection with a unifying service wrap centred on a 24/7 security operations centre (SOC) facility. During the engagement, we were presented with a time-critical challenge to assure the security of its essential Covid-19 research programme, which was part of a World Health Organization global megatrial on treatments. Our specialist team worked round the clock to ensure the infrastructure was penetration tested, remediated and added to 24/7 monitoring within three days. One year on, the customer’s cyber risk was detailed and demonstrated and a risk mitigation solution was designed and is now managed through a 24/7 MDR solution. The benefit is the university is better informed and more secure and the solution enables it to continue in its critical research and develop the next generation of leaders through its educational programmes. SURF partnership – protecting universities in the Netherlands In January 2021 we announced a partnership with SURF – the IT cooperative for education and research across the Netherlands – to provide 24/7 security incident and event management (SIEM) and security operations centre (SOC) services over the next five years. Our specialist team in Delft provides the services in support of SURFsoc – the security operations service launched by SURF, which is dedicated to securing and continuously monitoring the systems of all its member institutions. SURFsoc is a forward-thinking example of how industry-wide bodies, individual institutions and security teams can work together to improve the resilience of entire sectors and we are proud to be providing our expert services in support of this mission. This combination of ongoing knowledge sharing and 24/7 threat intelligence gathering is a model that will not only increase the resilience of individual educational institutions, but will be at the forefront of educational security around the world in the years to come. Inge Bryan Managing Director, Assurance Europe 28 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 34 + 33 + I Strategy and KPIs Executing our strategy We are successfully executing our strategy, realising our vision to become the complete provider of cyber and software resilience solutions globally. This section demonstrates how we are making progress to becoming a one-stop shop for our customers, offering them a complete set of cyber and software resilience services, which are promoted and sold to a global market, underpinned by research, data and quantification. In securing NCC Group’s future, we build on strong foundations to create a highly engaged and diverse talent base, as we continue to: • Broaden our portfolio, adding services and solutions across the complete Assess – Develop – Manage cyber lifecycle • Improve how we go to market globally, becoming easier to engage with and buy from Read more on our business model on pages 20 and 21 Link to risks: 1 Business strategy 2 Management of strategic change 3 Global pandemic – Covid-19 4 Availability of critical information systems 5 Attracting and retaining appropriate colleague capacity and capability 6 Information security risk (including cyber risk) 7 Quality of Management Information Systems (MIS) and internal business processes 8 Quality and Security Management Systems 9 Post-Brexit 10 Sustainability Read more on our risks on pages 40 to 48 Lead the market Deliver world-class research and thought leadership coupled with leaders who can gauge audiences and convey our message across all channels What we said we would do • Continue high impact research What we have achieved • Published 71 blog posts and 37+ technical advisories on our dedicated research blog, attracting a quarter of a million visitors • Released 35 open-source tools, and contributed to security standards development for C, Kubernetes and post-quantum cryptography • Recognised as some of Microsoft Security Response Center’s (MSRC) most valuable security researchers • Led the CyberUp Campaign to improve legal protections for cyber security and threat intelligence researchers Read more on page 49 • Commercial R&D accounted for up to nearly 1.5% of total revenue, under leadership of newly appointed Head of Commercial Research Read more on our research on pages 18 and 19 KPIs 3,400+ research days (2020: 3,300) 51 conference presentations, over 20 at Tier 1 venues (2020: 76) Link to risks 1 2 4 5 6 7 8 10 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 29 Strategic reportStrategic reportStrategy and KPIs continued Win business Deliver excellence Win high value work as a result of a deep understanding of our customers’ cyber needs in the context of their business What we said we would do • Create “One Global Offer” that articulates the full spectrum of our services to deliver the firm across the globe What we have achieved • Increased amount and effectiveness of marketing spend following formation of one global marketing team • Validated strategic focus on cloud, data, managed services and remediation solutions while creating a more consolidated and focused platform for future growth • Used agile methodology to deliver six new solutions in response to market demand, including a next generation SaaS platform for digital escrow deposits and secured digital vault storage, data science-based analytical and machine learning approaches to threat detection, and our new data-driven cyber risk quantification and peer comparison offer • Formally launched our Software Resilience Partner Network, working with 51 software vendor partners as their resilience partner of choice Deliver consistently high quality solutions that our customers value, fully utilising our global capability and the technical excellence of our consultants What we said we would do • Promote a global delivery model and embed new ways of working with our clients, providing a distinctive service What we have achieved • Invested £3m to launch and grow our new Remediation proposition globally, and expand our technology suite across Managed Detection and Response (MDR) to include Splunk, CarbonBlack and, now, Microsoft Sentinel • Implemented Global Assurance (specifically the creation of one EU business, Global Professional Services and Global Managed Services) to drive collaboration and unlock efficiencies through common delivery methodologies and global resourcing, and common technology stacks and global product development roadmaps • Launched a new customer operations team to provide a single post-sales interface for our UK Software Resilience customers KPIs Technical specialists increased by 49 (2020: 91) 10,600 days’ global resourcing (2020: 5,100 days) KPIs Revenue (£m) £270.5m . 3 5 1 2 . 0 3 3 2 . 7 0 5 2 . 7 3 6 2 . 5 0 7 2 17 18 19 20 21 134 orders with a value greater than £250k (2020: 144) £2.2m Software Resilience cloud proposition orders (EaaS) (2020: £1.2m) Link to risks 1 6 10 Link to risks 1 2 3 4 5 6 7 8 10 30 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Support growth Develop our people Provide the tools and processes that enhance how we work today enabling access to quality management information Create a positive colleague experience like no other offer in the industry, investing in our talent and organisation to unlock our full potential What we said we would do • Deploy systems that provide us with the information we need to run the business in an assertive and agile way What we have achieved • On track to build a system ready for the future, offering global visibility of quality data and improved efficiencies and profitability • YoY gross margin improvement of 1.4% • Systems and process landscape is more robust than ever • North America Assurance division pilot of Workday PSA and Kimble to improve user acceptance and embrace cultural change • Launch of Workday Adaptive to shift to active forecasting processes • Creation of benefits delivery team to drive business ownership and closer alignment across systems KPIs Adjusted operating profit (£m) 2,3 £39.2m . 8 0 3 . 7 3 3 . 7 0 3 . 5 5 2 . 2 9 3 17 18 19 20 (restated) 3 21 Cash conversion (%) 2,3 88.2% . 0 8 8 . 0 1 9 . 0 0 1 1 . 9 2 0 1 . 2 8 8 What we said we would do • Be a hub for cyber talent, and a quirky, distinctive environment where individuals and teams thrive • Support our people on learning and development What we have achieved • Launched a career framework and learning pathways pilot for our UK Assurance delivery colleagues across technical, consulting and management functions • Launched the Next Generation Manager Programme in the North America and UK Assurance divisions following its successful pilot in Software Resilience (100% of the initial cohort are now in manager roles) • Created a global people managers’ forum to support them to manage the drivers of engagement, and expanded our colleague forums globally, as part of a culture of active listening • Gender decoded our job adverts and piloted the redaction of CVs to remove unconscious bias Read more on our sustainability on pages 53 to 68 KPIs Attrition rate (%) 17.0% . 4 3 2 . 1 1 2 . 2 8 1 . 0 7 1 . 4 4 1 17 18 19 20 21 Engagement score (Best Companies) One to Watch Employee engagement score 642.7 (2020: 626.9) 17 18 19 20 (restated) 3 21 Link to risks 1 2 3 4 5 7 9 10 Link to risks 1 3 5 10 2 3 See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items. Further information is also contained within the Chief Financial Officer’s Review and the Glossary of terms on pages 187 and 188. See Note 34 for an explanation of the prior year restatement recognised in relation to the adoption of the IFRIC agenda decision on cloud configuration and customisation costs in April 2021. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 31 Strategic reportChief Financial Officer’s review Strong financial performance Total administrative expenses (including Individually Significant Items) have increased by £1.5m compared to the adjusted prior year figure mainly owing to a tighter control of overheads, a reduction on travel and office costs of c.£3m, a profit arising on disposal of an intangible asset of £0.5m and a reduction in amortisation of intangibles of £2.4m, offset by increased system licence costs of £1.3m, a foreign exchange charge of £1.5m, an increase in a share-based payment charge of £1.4m and an increase in Individually Significant Items of £4.8m. Following the adoption of the IFRIC agenda decision on cloud configuration and customisation costs, capitalised software and development costs during the year amounted to £2.3m (2020: restated £2.3m 3), with all cloud configuration and customisation costs now being expensed as incurred. Further details on the application of IFRIC agenda decision and prior year restatement are included later in this review. Operating profit has increased by 37.3% to £17.3m (2020: restated £12.6m 3) following the inclusion of Individually Significant Items of £12.7m (2020: restated £7.9m 3) in relation to the IPM US Acquisition (£7.6m) and cloud configuration and customisation costs associated with the Group’s SGT transformation programme (£5.1m, 2020: restated £7.9m 3). Operating profit also includes amortisation of acquired intangible assets of £6.4m (2020: £8.8m) and share-based payments of £2.8m (2020: £1.4m). Adjusted operating profit 2, 3 increased by 27.7% to £39.2m (2020: restated £30.7m 3). Adjusted EBITDA 2 increased by 15.4% to £52.5m (2020: £45.5m). Profit before taxation increased by 54.2% to £14.8m (2020: restated £9.6m 3) following the inclusion of Individually Significant Items noted above. Basis EPS amounted to 3.6p and diluted EPS amounted to 3.5p (2020: restated basic and diluted 2.3p 3). Adjusted basic EPS 2 amounts to 9.5p (2020: restated 7.6p 3). During the year, we secured the acquisition of the IPM business and following shareholder approval on 1 June we completed the transaction for $220m, subject to a normalised working capital adjustment. On this basis, the results of the IPM business will be consolidated from 1 June 2021. The acquisition was funded through an equity placing in May (£70.2m) combined with a new three year $70m term loan, existing cash balances and our revolving credit facility. Our Balance Sheet remains strong; we have continued to demonstrate effective cash management with cash conversion 2 of 88.2% and are now cash positive. Our Balance Sheet strength can therefore continue to fund organic and inorganic opportunities. The Board is also declaring an unchanged interim dividend of 3.15p per ordinary share (2020: 3.15p). This represents a dividend equal to that paid in the prior year as the Board is conscious of the need to invest in initiatives to support longer-term growth and service debt profile following the recent acquisition. The dividend policy will therefore continue to remain under review. Tim Kowalski Chief Financial Officer Our Balance Sheet strength can continue to fund organic and inorganic opportunities. Overview 1 We have delivered another period of good financial results, demonstrating our resilience during a global pandemic. During 2022, the Group will continue to strategically invest for the future with the expectation of higher revenue growth accompanied by increased global costs from inflationary pressures as well as a resumption in travel and office usage. Group revenues increased by 2.6%. On a constant currency basis 2, Group revenues increased by 3.6% due to the strengthening of Sterling against the US Dollar. In Assurance, the North American and EU Assurance businesses grew by 6.5% and 5.9% respectively on a local currency basis 3. Our UK and APAC region increased 3.9%, supported by growth in MDR and the launch of the Remediation service. Disappointingly, Software Resilience declined by 2.4%. This decline was mainly a result of execution challenges in a remote environment together with retaining sales colleagues and attracting sufficient sales resource to enable a return to contract growth. Gross profit increased by 5.9% to £110.6m (2020: £104.4m) with margin percentage increasing to 40.9% (2020: 39.6%) mainly owing to higher global resourcing and utilisation offset by a c.£2m provision taken in relation to long-term European contracts as a result of pandemic disruption, cost increases and project management challenges. Assurance margin percentage increased to 36.1% (2020: 34.0%) and Software Resilience decreased to 71.6% (2020: 73.3%) due to execution challenges. 1 2 3 References for the Group’s results are for continuing operations. See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items. Further information is also contained within the Chief Financial Officer’s Review and the Glossary of terms on pages 187 and 188. See Note 34 for an explanation of the prior year restatement recognised in relation to the adoption of the IFRIC agenda decision on cloud configuration and customisation costs in April 2021. 32 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Financial summary Summary Income Statement 1: £m Revenue Cost of sales Gross profit Depreciation and amortisation Other administration expenses Adjusted operating profit 2, 3 Individually Significant Items Acquired intangible amortisation Share-based payments Operating profit Finance costs Profit before taxation Taxation Profit for the year EPS Basic Diluted Revenue summary: £m Assurance Software Resilience Total revenue Operating profit summary: £m Assurance Software Resilience Central and head office Adjusted operating profit 2, 3 Individually Significant Items Acquired intangible amortisation Share-based payments Operating profit Operating profit margin % 2021 270.5 (159.9) 110.6 (13.3) (58.1) 39.2 (12.7) (6.4) (2.8) 17.3 (2.5) 14.8 (4.8) 10.0 3.6p 3.5p 2020 (restated) 3 263.7 (159.3) 104.4 (14.8) (58.9) % change 2.6% (0.4%) 5.9% 10.1% 1.4% 30.7 27.7% (7.9) (8.8) (1.4) 12.6 (3.0) 9.6 (3.2) 6.4 (60.8%) 27.3% (100.0%) 37.3% 16.7% 54.2% (50.0%) 56.3% 2.3p 2.3p 56.5% 52.2% 2021 2020 % change 233.9 36.6 270.5 226.2 37.5 263.7 3.4% (2.4%) 2.6% 2021 29.6 16.0 (6.4) 39.2 (12.7) (6.4) (2.8) 17.3 6.4% 2020 (restated) 3 22.3 16.9 % change 32.7% (5.3%) (8.5) 24.7% 30.7 27.7% (7.9) (8.8) (1.4) (60.8%) (27.3%) 100% 12.6 37.3% 4.8% 1.6% pts NCC Group plc — Annual report and accounts for the year ended 31 May 2021 33 Strategic reportStrategic reportChief Financial Officer’s review continued Financial summary continued Alternative Performance Measures (APMs) Throughout this Financial Review, certain APMs are presented. As discussed in the FY20 Annual Report and in accordance with FRC guidelines, the Group no longer presents a Consolidated Income Statement showing adjusting items separately. In prior periods, the Group disclosed adjusting items in 2020 of £10.2m relating to amortisation of acquired intangibles (2020: £8.8m) and share- based payments (2020: £1.4m) as a separate column on the face of the Consolidated Income Statement. This is no longer disclosed in this way to simplify the Group’s results. However, as the Group manages internally its performance at an Adjusted operating profit level (before Individually Significant Items, amortisation of acquired intangibles and share-based payments), which management believes better represents the underlying trading of the business, this information is still disclosed as an APM. This APM is reconciled to statutory operating profit, together with the consequently Adjusted basic EPS (before Individually Significant Items, amortisation of acquired intangibles, share-based payments and the tax effect thereon) to statutory basic EPS. This change has removed the following adjusted measures from the Group’s narrative reporting and disclosures: • Adjusted profit before taxation • Adjusted taxation Following this revision to APMs, the Group has the following APMs/ non-statutory measures: • Adjusted EBITDA (reconciled below and in Note 3) • Adjusted operating profit (reconciled below and in Note 3) • Adjusted basic EPS (pence) (reconciled in Note 10) • Net cash/(debt) excluding lease liabilities (reconciled in Note 3) • Net cash/(debt) (reconciled in Note 3) • Cash conversion (reconciled in Note 3) These measures provide supplementary information that assists the user to understand the financial performance, position and trends of the Group. Further detail is included within the glossary of terms to these Financial Statements that provide supplementary information that assists the user in understanding these APMs/non-statutory measures. The Group also reports certain geographic regions on a constant currency basis to reflect the underlying performance taking into account constant foreign exchange rates year on year. This involves translating comparative numbers to current year rates for comparability to enable a growth factor to be calculated. In addition, the Group also reports these regions on a local currency basis to demonstrate the revenue performance on a local basis. As these measures are not statutory revenue numbers, management considers these to be APMs; see Note 3 for further details. Divisional performance Divisional performance includes the allocation of certain central costs incurred on behalf of the divisions. Segmental information is disclosed below: 2021 Assurance £m Software Resilience £m Central and head office £m Revenue Cost of sales Gross profit Gross margin % General administrative expenses allocated Adjusted EBITDA 2 Depreciation and amortisation Adjusted operating profit 2, 3 Individually Significant Items Acquired intangible amortisation Share-based payments 233.9 (149.5) 84.4 36.1% (45.4) 39.0 (9.4) 29.6 – – – 36.6 (10.4) 26.2 71.6% (9.5) 16.7 (0.7) 16.0 – – – Operating profit 29.6 16.0 – – – – (3.2) (3.2) (3.2) (6.4) (12.7) (6.4) (2.8) (28.3) 2020 (restated) 3 Software Resilience £m Central and head office £m 37.5 (10.0) 27.5 73.3% (10.0) 17.5 (0.6) 16.9 – – – – – – – (5.0) (5.0) (3.5) (8.5) (7.9) (8.8) (1.4) Assurance £m 226.2 (149.3) 76.9 34.0% (43.9) 33.0 (10.7) 22.3 – – – 22.3 16.9 (26.6) Group £m 263.7 (159.3) 104.4 39.6% (58.9) 45.5 (14.8) 30.7 (7.9) (8.8) (1.4) 12.6 Group £m 270.5 (159.9) 110.6 40.9% (58.1) 52.5 (13.3) 39.2 (12.7) (6.4) (2.8) 17.3 2 3 See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items. Further information is also contained within the Chief Financial Officer’s Review and the Glossary of terms on pages 187 and 188. See Note 34 for an explanation of the prior year restatement recognised in relation to the adoption of the IFRIC agenda decision on cloud configuration and customisation costs in April 2021. The following additional information and reconciliation is noted in relation to Adjusted operating profit due to the adoption of the IFRIC agenda decision: Adjusted operating profit (as noted above) Proforma amortisation charge in respect of certain cloud-based software arrangements (see explanation below) Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements 2021 £m 39.2 (3.0) 36.2 2020 £m 30.7 (1.4) 29.3 Change 27.7% (114.3%) 23.5% The proforma amortisation adjustment noted above represents an estimate of the amortisation that would have been recognised had the Group not changed its accounting policy in the current year following additional clarification on the accounting in relation to the configuration and customisation costs incurred in implementing Software-as-a-Service (SaaS) arrangements in the IFRIC agenda decision issued in April 2021. The proforma amortisation charge is estimated based on cloud configuration and customisation costs charged to the income statement in the year of £5.1m (2020: £7.9m). The Directors consider that Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements is comparable to Adjusted operating profit previously reported. 34 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Amortisation of acquired intangibles decreased during the year as certain historical acquisitions became fully amortised. It is expected that for FY22, the charge will increase significantly following the US acquisition of the IPM business. Share-based payments increased during the year following the introduction of new share schemes for key management. Assurance The Assurance division accounts for 86.5% of Group revenue (2020: 85.8%) and 76.3% of Group gross profit (2020: 73.7%). Assurance revenue analysis – by originating country: UK and APAC * North America Europe * Total Assurance revenue 2021 £m 102.7 82.7 48.5 233.9 2020 £m 98.8 82.4 45.0 226.2 % change 3.9% 0.4% 7.8% 3.4% * With the continuing growth and formation of a European division we have changed geographical segments in line with how this information is reported to the Board and managed on an ongoing basis and have restated prior year figures on a like-for-like basis. The APAC division was previously included within the segment Europe and APAC. See the notes to the Financial Statements for further detail. Assurance revenue increased by 3.4% despite lower rechargeable travel expenses, foreign exchange and the ongoing disruption of a global pandemic. UK and APAC increased by 3.9% supported by growth in MDR and the launch of the Remediation service. North America grew by 6.5% on a local currency basis ($) and Europe experienced continued growth after benefit from multi-year product sales in 2020. Our global average order value increased by 2.3% year on year. Assurance revenue analysed by type of service/product line: Global Professional Services (GPS) ** Global Managed Services (GMS) ** Product sales (own and third party) Total Assurance revenue 2021 £m 172.2 56.2 5.5 233.9 2020 £m 166.2 49.6 10.4 226.2 % change 3.6% 13.3% (47.1%) 3.4% ** With the continuing global growth and focus on recurring revenues we have changed the type of service/product lines in line with how this information is to be reported to the Board and managed on an ongoing basis and have restated prior year figures on a like-for-like basis. Previously Risk Management Consulting was shown separately and is now included within Global Professional Services, and certain other activities are now included in Global Managed Services. Contained within GMS is Managed Detection and Response (MDR) which is considered the high growth service line due to the nature of the cyber resilience market. Product sale categorisation has remained the same. Global Professional Services grew by 3.6% to £172.2m (2020: £166.2m) supported by global resourcing with Covid-19 still felt across all geographies. During the year, day rates have remained consistent. Global Managed Services, a service line that provides operational cyber defence and managed security services, grew in total by 13.3% to £56.2m (2020: £49.6m). Within GMS, our MDR offering grew by 14.3% to £45.5m. Sales orders secured during the period amounted to £71.8m compared to £62.0m in 2020, a 15.8% increase, although slower procurement processes were still experienced due to the pandemic. Assurance gross profit is analysed as follows: UK and APAC * North America Europe * Assurance gross profit and % margin 2021 £m 41.0 27.4 16.0 84.4 2021 % margin 39.9% 33.1% 33.0% 36.1% 2020 £m 35.0 25.9 16.0 76.9 2020 % margin % pts change 35.4% 4.5% pts 31.4% 1.7% pts 35.6% (2.6% pts) 34.0% 2.1% pts Gross margin improved due to higher global resourcing (increased from 5,094 days to 10,602 days), lower client travel and billable utilisation (+7%) through remote delivery, offset by a c.£2m provision taken in relation to long-term European contracts caused by pandemic disruption, cost increases and project management challenges. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 35 Strategic reportStrategic reportChief Financial Officer’s review continued Divisional performance continued Software Resilience The Software Resilience division accounts for 13.5% of Group revenues (2020: 14.2%) and 23.7% of Group gross profit (2020: 26.3%). Software Resilience revenue analysis – by originating country: UK North America Europe Total Software Resilience revenue 2021 £m 25.2 7.3 4.1 36.6 2020 £m 25.9 7.8 3.8 37.5 % change (2.7%) (6.4%) 7.9% (2.4%) In Software Resilience, we experienced a disappointing overall revenue decline of 2.4%. This decline was mainly a result of execution challenges in a remote environment together with recruiting sufficient sales resource to enable a return to contract growth. The UK experienced a decline of 2.7% exacerbated by recruitment challenges in a pandemic market. North America declined 6.4% albeit 2.9% on a constant currency basis due to a decrease in on-premise testing. Europe, as a relatively new market, continued to progress positively during the year mainly due to increased testing revenues. Renewal rates improved to 89.2% (2020: 87.0%) and remain within our expected range. Software Resilience revenues analysed by service line: Software Resilience services revenue Software Resilience contracts Verification services Total Software Resilience revenue 2021 £m 24.0 12.6 36.6 2020 £m 25.8 11.7 37.5 % change (7.0%) 7.7% (2.4%) Our contract revenue was impacted by the pandemic and sales recruitment challenges. Our future expectation is that our nascent channel sales model will contribute to revenue going forward. Verification services grew 7.7% to £12.6m owing to the success of EaaS (£0.8m). Gross margin is analysed as follows: UK North America Europe 2021 £m 18.4 4.9 2.9 2021 % margin 73.0% 67.1% 70.7% 2020 £m 19.5 5.3 2.7 2020 % margin % pts change 75.3% (2.3% pts) 67.9% (0.8% pts) 71.1% (0.4% pts) Software Resilience gross profit and % margin 26.2 71.6% 27.5 73.3% (1.7% pts) Gross profit has declined due to the challenges noted above and as we started to make investments in our channel proposition and cloud infrastructure to underpin sustainable growth. Individually Significant Items During the period, the Group has incurred £12.7m of Individually Significant Items (ISIs) (2020: restated £7.9m 3). These items relate to the acquisition of the IPM business (£7.6m) and cloud configuration and customisation costs associated with the Group’s transformation programme SGT (£5.1m, 2020: restated £7.9m 3). These costs are considered material and are in accordance with the Group’s policy on identification of certain costs that distort the underlying performance of the Group. For further detail, please refer to Note 5 to the consolidated Financial Statements. 36 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Net finance costs Net finance costs for the period were £2.5m compared to £3.0m in 2020 due to the reduction in our drawn facilities and LIBOR during the global pandemic. Net finance costs include lease financing costs from IFRS 16 of £1.2m (2020: £1.2m). Taxation The Group’s effective statutory tax rate is 32.4% (2020: restated 33.3% 3). The Group’s adjusted tax rate is 27.8% (2020: 23.5%). The effective rate remains above the UK standard rate of corporation tax, reflecting the origin of a reasonable proportion of Group profits in overseas territories with higher tax rates than the UK and due to a review of US R&D tax credits recognition. Earnings per share (EPS) Statutory Basic EPS Diluted EPS Adjusted 2 Basic EPS 2021 pence 3.6p 3.5p 2020 (restated) 3 pence 2.3p 2.3p 9.5p 7.6p Cash flow and net debt 2 The table below summarises the Group’s cash flow and net debt 2: Operating cash inflow before movements in working capital Increase/(decrease) in trade and other receivables Increase in inventories (Decrease)/increase in trade and other payables Cash generated from operating activities before interest and taxation Interest element of lease payments Finance interest paid Taxation paid Net cash generated from operating activities Purchase of property, plant and equipment Software and development expenditure Proceeds on disposal of intangibles Equity dividends paid Repayment of lease liabilities Proceeds from the issue of ordinary share capital Net movement Opening net debt Non-cash movements (release of deferred issue costs and lease financing costs) Foreign exchange Closing net cash/(debt) excluding lease liabilities 2 Lease liabilities Closing cash/net (debt) 2 Free cash flow (net cash generated from operating activities less net capital expenditure) 2021 £m 2020 (restated) 3 £m 47.3 38.8 4.7 (0.2) (11.0) (0.2) (5.5) 19.2 46.3 (1.2) (1.1) (5.1) 38.9 (2.7) (2.1) 0.5 (13.0) (6.0) 72.6 88.2 (4.2) (0.2) (0.5) 83.3 (34.4) 48.9 46.8 (1.2) (1.6) (4.8) 39.2 (2.8) (2.5) – (12.9) (5.3) 1.1 16.8 (20.2) (0.2) (0.6) (4.2) (38.2) (42.4) 34.6 33.9 2 3 See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items. Further information is also contained within the Chief Financial Officer’s Review and the Glossary of terms on pages 187 and 188. See Note 34 for an explanation of the prior year restatement recognised in relation to the adoption of the IFRIC agenda decision on cloud configuration and customisation costs in April 2021. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 37 Strategic reportStrategic report Chief Financial Officer’s review continued Cash flow and net debt 2 continued Net cash/(debt) 2 can be reconciled as follows: Cash and cash equivalents Borrowings (net of deferred issue costs) Net cash/(debt) excluding lease liabilities 2 Lease liabilities Net cash/(debt) 2 2021 £m 116.5 (33.2) 83.3 (34.4) 48.9 2020 £m 95.0 (99.2) (4.2) (38.2) (42.4) The calculation of the cash conversion ratio 2 is set out below: Net operating cash flow before interest and taxation (A) Adjusted EBITDA 2 (B) Cash conversion ratio 2 (%) (A)/(B) 2021 £m 46.3 52.5 2020 (restated) 3 £m % change 46.8 45.5 (1.1%) 15.4% 88.2% 102.9% (14.7% pts) Cash conversion remains above our medium target of c.85%, as we have maintained strong cash management through the global pandemic. The increase in tax paid is mainly due to the FY20 deferral of £1.2m under government tax deferral schemes now fully repaid. Net cash capital expenditure during the year was £4.3m (2020: restated £5.3m 3) which includes tangible expenditure of £2.7m (2020: £2.8m) and capitalised software and development costs of £2.1m (2020: restated £2.5m 3), which has been offset by proceeds from the disposal of an intangible asset for £0.5m. Additional cash capital expenditure will be incurred during 2022 as we finish the installation and improve our new systems. Acquisition costs paid prior to the shareholder approval on 1 June 2021 of the US acquisition of IPM amounted to £1.2m. During early FY22, further costs have been paid of c.£6.4m. Dividends Dividends of £13.0m paid in the year (2020: £12.9m) comprised the final dividend for FY20 of 3.15p and the interim dividend of 1.5p per ordinary share for FY21 (2020: 1.5p). The Board is declaring an unchanged final dividend of 3.15p per ordinary share (2020: 3.15p). This represents a dividend equal to that paid in the prior year as the Board is conscious of the need to invest in initiatives to support longer-term growth and service debt profile following the recent acquisition. The dividend policy will therefore continue to remain under review. The final dividend will be paid on 12 November 2021, to shareholders on the register at the close of business on 15 October 2021. The ex-dividend date is 14 October 2021. IPM acquisition and future statutory reporting As noted within the Business Review, prior to our ownership of IPM, the business generated revenues of c.£23m and operating profit of c.£15m for the 12 months ended 31 December 2020, with cash conversion of c.90%. It is expected that for NCC Group’s FY22 financial year, the business will report proforma numbers on a similar basis and that we will incur c.£2.5m of one-off integration costs. However, on a statutory basis the Group will have to recognise acquisition fair value adjustments for the first year only in relation to deferred income, resulting in an expected consequential reduction to IPM numbers in relation to revenue and operating profit for the first year only. Application of IFRIC agenda decisions and prior year restatement In April 2021, the IFRS Interpretations Committee (IFRIC) published an agenda decision on the clarification of accounting in relation to the configuration and customisation costs incurred in implementing Software-as-a-Service (SaaS) as follows: • Amounts paid to the cloud vendor for configuration and customisation that are not distinct from access to the cloud software are expensed over the SaaS contract term • In limited circumstances, other configuration and customisation costs incurred in implementing SaaS arrangements may give rise to an identifiable intangible asset, for example, where code is created that is controlled by the entity • In all other instances, configuration and customisation costs will be expensed as the customisation and configuration services are received Due to the nature of this agenda decision and the level of spend incurred in relation to the Group’s Securing Growth Together digital transformation programme, the Group’s accounting policy has been reviewed retrospectively to align with the IFRIC guidance recently issued in relation to SaaS costs previously capitalised. This has resulted in a prior year restatement to reflect costs previously capitalised as an expense when incurred and represents a non-cash adjustment. See Notes 1, 5, 12 and 34 to the Financial Statements for further details. Financing facilities The Group is financed through a combination of bank facilities, retained profits and equity. As at 31 May 2021, the Group had committed bank facilities (revolving credit facility) of £100m (2020: £100m), of which £33.8m (2020: £100m) was drawn down. These arrangements were agreed in June 2019 and are due for renewal in June 2024. Under these arrangements the Group can also request (seeking bank approval) an additional accordion facility to increase the total size of the revolving credit facility by up to £75m. On 12 May 2021, the Group entered into a new Term Loan Facility Agreement of $70m, to fund the US acquisition of the IPM Software Resilience business in early June 2021. The Term Facility is repaid in annual instalments of $23.3m on each of 10 June 2022 and 10 June 2023, with a final instalment of $23.4m payable on 10 June 2024. The Term Facility Agreement also contains financial covenants consistent with the revolving credit facility. On our banking covenants, leverage as at 31 May 2021 amounted to (1.8)x as we have become cash positive (2020: 0.1x) and net interest cover amounted to 35.0x (2020: 22.7x). The Group was in compliance with the terms of all its facilities, including the financial covenants, at 31 May 2021 and expects to remain in compliance with the terms going forward. The terms and ratios are specifically defined in the Group’s banking documents (in line with normal commercial practise) and are materially similar to GAAP with the exceptions being net debt excludes IFRS 16 lease liabilities and Adjusted EBITDA 2 excludes amortisation of acquisition intangibles, share-based payments and Individually Significant Items. 38 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Going concern The Directors have acknowledged guidance published in relation to going concern assessments. The Group’s business activities, together with the factors likely to affect its future development, performance and position, are set out in the Business Review and Financial Review. The Group’s financial position, cash and borrowing facilities are also described within these sections. The Financial Statements have been prepared on a going concern basis which the Directors consider to be appropriate for the following reasons. The Directors have prepared cash flow and covenant compliance forecasts for the 12 month period ending September 2022 which indicate that, taking account of severe but plausible downsides and the anticipated impact of Covid-19 on the operations of the Group and its financial resources, the Group and Company will have sufficient funds to meet their liabilities as they fall due for that period. The Group is financed primarily by a £100m committed revolving credit facility that matures in June 2024. The Group is required to comply with financial covenants for leverage (net debt to Adjusted EBITDA 2) and interest cover (Adjusted EBITDA 2 to interest charge) that are tested bi-annually at 31 May and 30 November each year. As at 31 May 2021, the Group had drawn down £33.8m for working capital requirements. Subsequent to the year end and shareholder approval on 1 June, the Group acquired on 7 June the IPM business for $220m; the US acquisition was funded through an equity placing in May of £70.2m (net proceeds) combined with a new three year $70m term loan, existing cash balances and our existing revolving credit facility. The impact of the acquisition on the Group’s financial performance, covenants and business model has therefore been considered within this going concern assessment. As at 2 June 2021, following the acquisition of the IPM business, the Group had drawn down £75.5m of its revolving credit facility and was due to incur further transaction costs of £6.4m. As at 31 August 2021, cash, net debt (excluding lease liabilities) 2 and headroom amounted to £43.6m, £74.7m and £80.5m respectively. Although the Group has demonstrated resilience to the challenging environment resulting from Covid-19, the Directors acknowledge that the financial performance of the Group has been adversely impacted to a certain degree since the commencement of the pandemic, and for this reason the base case forecast for 2021 reflects this assessment. The continuing macro-economic risks and potential changes in government policies (on the severity of enforced lockdowns worldwide) could have a continued effect on the Group’s performance. However, trading throughout the pandemic has demonstrated resilience. The Directors have prepared a number of severe but plausible scenarios as follows: 1. 2. 3. 4. 5. The performance of FY22 continues to be similar to that of 2021, including the impact on regional and international operations of the Group and a potential reduction in growth. An additional impact of Covid-19 during a two month period from January to February 2022 which coincides with a similar economic pandemic pattern as 2021. Potential impact of customers’ inability to pay during a specified period. Failure of execution of the strategy, loss of key customers and a number of acquisition related risks crystallising (for example increased customer churn, integration and cash collection issues). Software Resilience performance does not return to growth and the Assurance business experiences similar impact of Covid-19 on its performance as 2021. These scenarios have been modelled individually and also in combination in order to assess the Group’s ability to withstand multiple challenges, although the Directors do not believe a scenario combining all these risks to be plausible. The impact of these sensitivities has been reviewed against the Group’s projected cash flow position, available bank facilities and compliance with financial covenants. In the instance that a combination of the above scenarios arise, mitigating actions would be required to ensure that the Group remains liquid and financially viable, which might include a reduction of planned capital expenditure, freezing pay and recruitment and not paying a dividend to shareholders. All of the mitigating actions are within the Directors’ control. These forecasts, including the severe but plausible downsides, show that the Group is able to operate within its available banking facilities, with no forecasted covenant breaches, and that the Group will have sufficient funds to meet its liabilities as they fall due for that period. From a Company perspective, the Company places reliance on other Group trading entities for financial support. Having reviewed the current trading performance, forecasts, other Group trading entities’ financial support, debt servicing requirements, total facilities and risks, the Directors are confident that the Company and the Group will have sufficient funds to continue to meet their liabilities as they fall due for a period of at least 12 months from the date of approval of these Financial Statements. Accordingly, they continue to adopt the going concern basis of accounting in preparing the Group’s Financial Statements for the year ended 31 May 2021. Brexit The Group’s operations based in Continental Europe have so far proven structurally resilient to any significant disruption caused by Brexit. The main risks to the Group from Brexit continue to be any reduction in demand from an economic slowdown as well as real or perceived differences in data protection standards which impact our global ways of working. Tim Kowalski Chief Financial Officer 14 September 2021 2 3 See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items. Further information is also contained within the Chief Financial Officer’s Review and the Glossary of terms on pages 187 and 188. See Note 34 for an explanation of the prior year restatement recognised in relation to the adoption of the IFRIC agenda decision on cloud configuration and customisation costs in April 2021. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 39 Strategic reportStrategic reportPrincipal risks and uncertainties Embedded risk management systems Embedded risk management systems have supported the Group in pursuing its strategy for sustainable and profitable growth. Risk management Risk is an inherent part of doing business and risk management is a fundamental part of good corporate governance. A successful risk management process balances risk and reward and is underpinned by sound judgement of their impact and likelihood. The Board has overall responsibility for ensuring that NCC Group has an effective risk management framework, which is aligned to our business objectives. The Board has established a Risk Management Policy, which has established protocols, including: • Roles and responsibilities for the risk management framework • Risk scoring framework • A definition of risk appetite The integrated approach to risk management diagram summarises the Group’s overall approach to risk management, which is supported by a web-based tool – the Integrated Risk Management System (IRMS). The tool is designed to follow the risk management model described in the next section and records both strategic and operational risk registers and tracks risk mitigation action plans, helping embed ownership of risks and treatment actions while also providing access to live management information, which is used at both a Board and operational management level. NCC Group’s approach to risk management NCC Group adopts both a “top down” and “bottom up” approach to risk, to manage risk exposure across the Group to enable the effective pursuit of strategic objectives. The approach is summarised in the diagram on page 41. The approach is one of collaboration, which supports our comprehensive approach to risk identification, from the “top down” and “bottom up”. The Group believes that this is the most efficient and effective way to identify its business risks. Top down The Board, Audit Committee and Cyber Security Committee review risks on an ongoing basis and are supported by the Executive Committee and subject matter specialists (including Software Resilience, Assurance, information security, data protection and health and safety). The Board gives consideration to the Group’s strategic objectives and any barriers to their achievement. Bottom up The Board and senior leadership team engage with colleagues at every level of the Group in recognition of the importance of their expertise, contribution and views. In relation to matters of wrongdoing, or risks not being recognised and adequately managed, the Group has a robust and effective whistleblowing procedure, which is supported by the Safecall reporting line. 40 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Top down Strategic risk management Bottom up Operational risk management • Establishing guidance on the Group’s approach to risk management and establishing the parameters for risk appetite and associated decision making • Identification, review and management of identified Group strategic risks and associated actions • Ongoing consideration of: – IT and cyber-centric risk – Environmental risk • Implementing and embedding the Group’s Risk Management Policy and approach • Directing the delivery of the Group’s identified actions associated with managing/mitigating risk • Identification of key risk indicators, monitoring and taking timely action where appropriate • Instrumental in developing the risk management framework adopted by the Board • Providing governance and control over the IRMS • Conduit between the Board and the business units – providing training and support where appropriate • Developing and executing a risk-based internal audit plan to assess the management of risks • Execution of the delivery of the Group’s identified actions associated with managing risk • Timely reporting on the implementation and progress of agreed action plans • Provision of key risk indicator updates n w o d p o t e h t m o r f i k s i r g n g a n a M Board Audit Committee Cyber Security Committee • Periodically assessing the effectiveness of the embedded Group risk management process • Challenging the content of the strategic risk register to support a comprehensive and balanced assessment of risk • Reporting on the principal risks and uncertainties of the Group Executive Board and leadership team • Responsible for reviewing the operational risks across the business units and Group • Challenging the appropriateness and adequacy of proposed action plans to mitigate risk • Giving due consideration to the aggregation of risk across the Group • Provisioning suitable cross-functional/business unit resource to effectively manage risk where appropriate Global Governance function, incl. dedicated CISO • Ongoing monitoring and reporting to the Board in relation to the progress being made by the business units in implementing agreed action plans to mitigate strategic risk • CISO dedicated to the identification, management, monitoring and reporting of data security risks Business units • Identification and reporting of strategic risk to the Board • Provision of reports and data relating to significant emerging risks to the Group (internal and external) • Implementation of risk management approach which promotes the ongoing identification, evaluation, prioritisation, mitigation and monitoring of operational risk M a n a g n g r i s k i f r o m t h e b o t t o m u p Effective pursuit of strategic objectives NCC Group plc — Annual report and accounts for the year ended 31 May 2021 41 Strategic reportStrategic report Principal risks and uncertainties continued C o r p o r a te governance Identify risks M onito r Monitor delivery of action plans/ risk universe Id e n tif y Identify inherent risks and likelihood of impact Risk management model Develop action plans (treat, transfer, tolerate, terminate) Assess adequacy and effectiveness of existing controls A d d r e s s Assign Director-level sponsorship Evaluate mitigated risks and likelihood of impact A ssess Corporate gov e r n a n c e Risk management model The Board has overall responsibility for ensuring that NCC Group adopts an effective risk management model, which is aligned to our objectives and promotes good risk management practice. We have therefore adopted the model described in this section and summarised in the diagram above. The Board, Audit Committee, Cyber Security Committee and Executive Team review risks on an ongoing basis throughout the year. The appropriateness and relevance of the risks and issues tracking system – IRMS – are monitored by the global governance team to ensure that it continues to be updated, meets the needs of the Group and remains in line with good risk management practice. In addition, there is a robust process in place for monitoring and reporting the implementation of agreed actions. We are satisfied that the Risk Management Policy, framework and model currently in place are sufficient to manage risk across the Group. The key areas of identifying, assessing, addressing and monitoring risks are explained in more detail below: Identify Risks exist within all areas of our business and it is important for us to identify and understand the degree to which their impact and likelihood of occurrence will affect the delivery of our key objectives. This is achieved through day-to-day working practices and incorporates risks in both the internal and external environment. Examples of identification include horizon scanning for legislative and market changes, operational and delivery reviews (such as SGT), procedures in relation to projects and change and independent systems audits. All identified risks are initially assessed for their “inherent” risk (risk with no controls in place), using a scoring mechanism that accounts for the likelihood of an event occurring and the impact that it may have on the Group. The scoring mechanism adopted takes account of high impact, low likelihood events and these risks are managed in a timely manner. In addition to ongoing risk identification, an annual exercise is undertaken to review the Group’s strategic risk universe by the Board. This exercise is reliant on the “top down” “bottom up” approach discussed earlier. Assess Post identification of the Group’s inherent risk exposure, a comprehensive assessment of the effectiveness of current mitigating controls is undertaken. This exercise takes account of the design of the current control environment and the application of these controls prior to assessing the Group’s current exposure to risk – mitigated risk score. The Board uses a number of sources of information to support the scoring of risk and these include, but are not limited to: • Management updates • Action tracking and reporting • Control environment policies and procedures • Independent audit activity • Project monitoring reports Address Having identified and assessed the risks faced by the Group, the risks are scored according to likelihood of occurring and impact to the business should they occur. The risks are then mapped according to their rating onto a risk heat map, which reflects the Group’s overall risk appetite set by the Board. The Group’s Risk Management Policy then provides guidance on the expected level of response to those risks, depending on where they sit on the risk heat map. The heat map shows the four bandings in the different shades of risks as set out below as well as expected actions and responses to risks in these areas: • Green – within appetite. Ongoing monitoring in place • Amber – out of appetite. Some actions are required to treat the risk to bring this within acceptable levels • Purple – significantly out of appetite. High combination of residual probability and impact. Management actions required, with some urgency, to treat the risk, reducing this to acceptable levels • Grey/black – risks that are deemed to have such an impact that they could theoretically impact the ability of the business to continue in existence. If any, they would need consideration in assessing in the Directors’ Viability Statement An assessment of whether additional actions are required to reduce our risk exposure is undertaken, with actions falling into the one of four categories: • Treat – develop an action plan (applying responsibility, deadlines and prioritisation) that may include the implementation of additional controls, or increase the requirement for additional assurance over the adequacy and effectiveness of the existing controls • Transfer – use a third party specialist to undertake the activity, thus mitigating the risk • Tolerate – determine the risk is within appetite • Terminate – exit the activity Output from the evaluation of strategic risks has resulted in milestone plans owned by senior business leaders, or has been used in the development of the Group’s transformation programme. 42 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 h g H i t c a p m I 8 4 3 7 1 11 6 5 10 9 2 w o L Low 1 Business strategy 2 Management of strategic change 3 Global pandemic – Covid-19 4 Availability of critical information systems 5 Attracting and retaining appropriate colleague capacity and capability 6 Information security risk (including cyber risk) Likelihood High 7 Quality of Management Information Systems (MIS) and internal business processes 8 Quality and Security Management Systems 9 Post-Brexit 10 Sustainability 11 Acquisition of IPM Monitor Ongoing monitoring of risks and related actions is key to the implementation of our risk management model and, therefore, NCC Group is committed to making enterprise-wide risk management part of business as usual. Examples of ongoing monitoring of business risks include, but are not limited to: • Annual review of the external audit strategy and plan by the Audit Committee and Chief Financial Officer to ensure inclusion of key financial risks • Annual review of the annual internal audit plan to validate that it incorporates key areas of business risk • At each Audit Committee, a review of internal audit reports issued during the period, including a summary of progress against previously raised management actions • Annual review of the strategic risk register by the Enterprise Risk Management Steering Group (introduced in FY21) and Board to ensure that it includes risks arising in year Internal control Whilst risk management identifies threats to the Group achieving its strategic objectives, internal controls are designed to provide assurance that these objectives are being achieved, such as the effectiveness and efficiency of operations and delivery, accurate and reliable financial reporting, and compliance with applicable laws and regulation. NCC Group has established a robust internal control framework which is made up of a number of components: Control environment The control environment has primarily been established taking account of the Group’s values (working together, being brilliantly creative and embracing difference) and its Code of Ethics, which sets the foundations for the expected behaviours, values and competencies for all colleagues across the Group. The Board, Executive Committee and extended leadership team lead by example and strive to maintain effective control environments, whilst also maintaining integrity and transparency. Risk assessments Risk assessments are conducted at both a strategic and operational level of the Group and support the Group in understanding the risks that it faces and the controls in place to mitigate them. Importantly, they provide a mechanism to identify operational improvements which is vital in our transformational programmes. Policies and procedures Established policies communicate expected behaviours and these are supported through procedures and guidelines defining required processes and controls. This in turn supports the business to adopt efficient and effective control environments. Information and communication Access to accurate and timely data is key in supporting our colleagues to make decisions and to be well informed in order to conduct, manage and control their areas of responsibility. During the year, the Group has continued to focus on its data systems – rolling out the Workday Finance system to support consistent controls and reporting. Activity monitoring Financial minimum controls were established during FY20 for local finance teams. The financial minimum controls have been self- assessed by all finance teams and a programme of audit against these standards launched in FY21. The financial minimum controls framework was established in consultation with the Chief Financial Officer, Group Financial Controller and local Finance Directors and has taken account of the implementation of Workday Finance. Further enhancement of the framework is being considered in preparation for potential changes proposed in the Brydon Review and related white paper issued by the Department for Business, Energy and Industrial Strategy. Financial accounting and reporting follows generally accepted accounting practices. Group review and approval procedures exist in relation to major areas of risk and require Executive Committee/Board approval, including mergers and acquisitions, major contracts, capital expenditure, litigation, treasury management and taxation policies. Compliance with all legislation, current and new, is closely monitored. Risk and control reporting structure During the current financial year, NCC Group has focused on establishing the “three lines of defence” to provide a robust internal controls structure that will support the Board, Audit Committee, Cyber Security Committee, Executive Committee and extended leadership team with accurate and reliable information in relation to the systems of internal control. Three lines of defence: • First line – Group policies and procedures • Second line – Global Governance function, incorporating Health and Safety; Information Security; Data Protection; Compliance and Standards; and Corporate Legal • Third line – independent challenge and assessment, including ISO certification and internal and external audit NCC Group plc — Annual report and accounts for the year ended 31 May 2021 43 Strategic reportStrategic reportPrincipal risks and uncertainties continued Principal risks and uncertainties The Group continues to operate in a particularly dynamic and evolving marketplace. The current strategic risk register has been developed to reflect those factors and includes those risks that would threaten its business model, future performance, solvency or liquidity. Detailed descriptions of the current principal risks and uncertainties faced by the Group, their potential impact and mitigating processes and controls are set out below. A risk related to sustainability (10) has been added to the strategic risks for FY21 and reflects the importance being placed on a sustainable business strategy by NCC Group and its investors. The heat map provides a pictorial representation of the Group’s strategic risks and their direction of travel. Strategic 1. Business strategy VR Link to strategy: Lead the market Win business Deliver excellence Support growth Develop our people A comprehensive business strategy is essential to the continued success of the Group as we strive to maximise shareholder value. Accountable Executive Adam Palser, Chief Executive Officer Impact A poor strategy or ineffective execution of a strategy could have a material negative impact on the Group’s financial performance and value. It would potentially weaken the Group compared to its competitors and risk the Group’s established position in the marketplace. Key controls and mitigating factors Members of the Board have significant experience in evolving business strategies. The Board is significantly engaged in both setting and reviewing strategy and held a dedicated strategy session in March 2021. Risk movement/impact 2. Management of strategic change Link to strategy: Win business Support growth Develop our people As the Group adapts and executes its strategy there are a number of complex projects and initiatives that not only need to be delivered but also require understanding and support from all colleagues. Impact Poor change management could lead to ineffective implementation of projects that then cost more to deliver, take longer to deliver and result in fewer benefits being realised (or all three). Poor delivery of change could ultimately impair business performance. Key controls and mitigating factors The Group has established a strategic change management capability and this includes access to programme management professionals and the deployment of associated change management processes, for example the operation of senior change oversight committees. Accountable Executive Adam Palser, Chief Executive Officer Operational Risk movement/impact 3. Global pandemic – Covid-19 Link to strategy: Lead the market Support growth Develop our people NCC Group has a number of features which give the Group greater resilience in the face of a global pandemic. Failure to prepare for this may cause disruption and uncertainty to our business, as well as risk the health and safety of our people. Any disruption or uncertainty could have an adverse effect on our business, financial results and operations. Accountable Executive Tim Kowalski, Chief Financial Officer Impact The potential impact of a pandemic globally is closed offices, people who are unwell and unable to work for periods of time and a slow-down in business from our clients. Risk movement/impact Key controls and mitigating factors During 2021, we successfully moved to remote working during the lockdown periods across our offices and were able to deliver our services off client sites. We have also used remote working as an opportunity to develop our services to support remote delivery. In addition, the Group has developed an office re-opening programme, which has taken into account the health and wellbeing of our colleagues, which has further supported our successful service delivery. Risk movement: Increased Decreased Unchanged Risk impact: High Medium Low Viability risk: VR New risk: NR 44 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 4. Availability of critical information systems VR Link to strategy: Win business Support growth Develop our people Impact If the Group’s critical systems failed, this could affect the Group’s ability to provide services to our customers. Risk movement/impact The Group is heavily reliant on continued and uninterrupted access to its IT systems. As well as environmental and physical threats, the Group is a natural target for individuals who may seek to disrupt the Group’s commercial activities. Accountable Executive Steve Boughton, Global Operations Director Key controls and mitigating factors The Group continues to make significant investment in its IT infrastructure to ensure it continues to support the growth of the organisation. This has been particularly pertinent during home working as part of the response to Covid-19. The Group has controls in place in order to reduce the risk of actual loss of critical systems; this has included a review of single points of failure and these have been mitigated. Further, controls are operated to ensure the availability of backup media in the event of prolonged loss of systems. The Group also standardises and simplifies processes whilst increasing resilience. Additional focus is given to proving the recoverability of systems and data. 5. Attracting and retaining appropriate colleague capacity and capability VR Link to strategy: Lead the market Win business Support growth Develop our people The Group would be adversely impacted if it were unable to attract and retain the right calibre of skilled colleagues. Some roles within the Group operate in highly technical and extremely specialised areas in which there are shortages of skilled people. Accountable Executive Colin Watt, Chief People Officer Impact Loss of key colleagues or significant colleague turnover could result in a lack of necessary expertise or continuity to execute the Group’s strategy. Key controls and mitigating factors Colleagues are offered a rewarding career structure and attractive salary and benefits packages, which can include participation in share schemes. An inability to attract and retain sufficient high- calibre colleagues could become a barrier to the continued success and growth of NCC Group. Comprehensive communications with our colleagues are ongoing and include all-hands calls, The Wire and Group and local communications. Risk movement/impact Linked to the development of our people, the Group continues to review our values and continues to use personal performance management processes, and aligned development programmes, which are linked to succession planning. 6. Information security risk (including cyber risk) VR Link to strategy: Win business Deliver excellence Support growth Due to the nature of the services provided by NCC Group, clients have a high expectation of the systems, processes and people handling their data. In addition, as a cyber security provider, NCC Group is more exposed to its systems being maliciously compromised. As a result, NCC Group could experience a malicious cyber- attack, inadvertent disclosure and/ or compromise of confidential data and/or any other information security incident. Accountable Executive Steve Boughton, Global Operations Director Impact Failure to maintain control over customer, colleague, commercial and/or operational data could lead to a range of impacts, including reputational damage. The misuse of personal data, for example without the customer’s consent, or retaining data for longer than is necessary, may also result in reputational harm, regulatory investigations and potential fines. Risk movement/impact Key controls and mitigating factors The Board operates a Cyber Security Committee chaired by the Chair of the Board and is responsible for the ongoing oversight of this risk and related control environments. All colleagues globally are required to undertake annual security training and updates to alert them to potential methods of security breach and to their responsibilities in safeguarding information and reporting potential issues. Security testing is regularly carried out on the Group’s infrastructure and there are extensive response plans, which were reviewed during the year, in the event of a major security incident. Comprehensive plans are in place and being delivered associated with discharging our data protection obligations. Risk movement: Increased Decreased Unchanged Risk impact: High Medium Low Viability risk: VR New risk: NR NCC Group plc — Annual report and accounts for the year ended 31 May 2021 45 Strategic reportStrategic report Principal risks and uncertainties continued Principal risks and uncertainties continued Operational continued 7. Quality of Management Information Systems (MIS) and internal business processes VR Link to strategy: Win business Support growth Develop our people We need to ensure that trusted and relevant MIS are available on a day-to-day basis to inform management decisions and drive performance. Accountable Executive Tim Kowalski, Chief Financial Officer Impact Suboptimal business decision making and performance as key financial performance data is not available or trusted. Risk movement/impact 8. Quality and Security Management Systems Link to strategy: Win business Support growth We aspire to attain and retain key internationally recognised standards, which form an important component for many of our customers. Accountable Executive Tim Kowalski, Chief Financial Officer Impact The risk of the Group failing to retain a core standard, e.g. 9001, 27001 or PCI, with a consequential loss of key customer accounts or ability to operate. Risk movement/impact 9. Post-Brexit Link to strategy: Develop our people Failure to comply with changing EU regulations as a result of Brexit may cause disruption to our business. Any disruption could have an adverse effect on our business operations. Accountable Executive Tim Kowalski, Chief Financial Officer Impact There remains some uncertainty around the detail of EU regulatory changes as these are finalised (for example, finalisation of trade negotiations with the wider world), which may impact on some of the services delivered by the Group, which fall under export control regulations. Risk movement/impact Key controls and mitigating factors The Group finance function has developed a forward-facing Finance Functional Strategy. Enhancements were identified covering system and process standardisation. A comprehensive milestone plan is in place and progress is tracked and reported to each Audit Committee. The rollout of Workday across our global finance teams has been significantly completed and will support the standardisation of policies and procedures, in addition to improving efficiency and effectiveness. Standardised business process control standards are in place across all parts of the Group. Financial year 2021 has seen the implementation of the new control self-assessment questionnaires along with an aligned programme of internal audits. Key controls and mitigating factors We operate a comprehensive programme to ensure the retention of our core standards. This includes a portfolio of aligned policies and cascading business processes. A programme of internal audit provides assurance over the design and application of these policies and procedures. External assessors provide a further layer of review and challenge, confirming during the year the retention of our Quality and Security standards, which were renewed in April 2021. VR Key controls and mitigating factors Similar to any UK company, we list post-Brexit as a significant risk due to the continued uncertainty surrounding the final EU post-Brexit trade deals with Europe and other international countries, which are still being negotiated. As our operations around the world include business entities based in Continental Europe and the wider world, we believe NCC Group is structurally resilient to the post-Brexit trading environment. The main risks to our business post-Brexit are: • Changes to export control requirements and related tariffs being implemented which may impact on some areas of service delivery • Real or perceived differences in data protection standards, which impact our global ways of working Risk movement: Increased Decreased Unchanged Risk impact: High Medium Low Viability risk: VR New risk: NR 46 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 10. Sustainability Link to strategy: Support growth Develop our people NCC Group recognises the importance of good environment, social and governance (ESG) frameworks as a key indicator of the Group’s sustainability and ethical impact of our business. Accountable Executive Yvonne Harley, Global Director of Sustainability and Corporate Affairs Impact Non-compliance with the Group’s frameworks related to ESG will impact on our ability to display robust working practices, grounded in good working practice, which take account of our environment, people and communities. This in turn could impact on our ability to develop and maintain business relationships and may lead to the loss of key customer accounts and shareholder investment. Risk movement/impact New NR Key controls and mitigating factors The Group has developed an ESG framework which continues to evolve. Examples of progress to date include: • Ongoing review of key policies, such as the Code of Ethics, Whistleblowing Policy, Anti-Bribery and Corruption Policy and Anti-Trust Policy. These policies reflect our global footprint and will be translated into all of our jurisdictional languages in 2022 • Maintained our corporate governance and decision-making structures during the “move to remote” during Covid-19 lockdowns More examples are outlined in the sustainability section of the report. 11. Acquisition of IPM (Intellectual Property Management) NR Link to strategy: Deliver excellence Support growth Develop our people Impact Ineffective implementation of the integration plan may lead to: • Staggered transition to key systems • Increased costs against the budgeted £2.5m Risk movement/impact New Key controls and mitigating factors The Group has established a comprehensive integration plan, which has been sub-divided into specific workstreams, including, but not limited to, finance; legal; compliance; and IT. Each workstream has specific deliverables, along with deadlines, and these are being regularly monitored to validate “on time” delivery and to enable additional actions/resource to be deployed if required. NCC Group obtained shareholder approval to acquire Iron Mountain’s Intellectual Property Management (IPM), post extensive due diligence on 1 June 2021. The acquisition of the IPM division significantly grows the US Software Resilience customer base and allows us to support them with a broader set of services. A comprehensive integration plan has been established to support the effective and efficient transition of IPM into the Group. Accountable Executive Simon Fieldhouse, Global Managing Director – Software Resilience Risk movement: Increased Decreased Unchanged Risk impact: High Medium Low Viability risk: VR New risk: NR Extraordinary risk during the year During the year, the global pandemic of Covid-19 continued, with minimal impact on financial performance; it also provided opportunities. The Group mobilised its Executive Support Team and its business continuity plan in January 2020 and this enabled a number of planned initiatives to be brought forward to support a Group-wide response to remote working and delivery. We have continued to successfully negotiate with our customers where appropriate to work remotely, which has minimised disruption to service delivery. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 47 Strategic reportStrategic reportPrincipal risks and uncertainties continued Viability Statement The context for assessment In accordance with the requirements of the UK Corporate Governance Code, the aim of the Viability Statement is for the Directors to report on the assessment of the prospects of the Group meeting its liabilities over the assessment period, taking into account the current financial position, outlook, principal risks and uncertainties and key judgements and estimates in preparing the Financial Statements. The Directors have based their assessment of viability on the Group’s current business model and strategic plan, which is updated and approved annually by the Board, in line with our objectives to deliver sustainable and profitable growth, increase shareholder value and offer an improved service and product offering to our customers. This is underpinned by the strategic priorities outlined on pages 20 and 21 of the Strategic Report. The effective management of principal risks and uncertainties is outlined within pages 40 to 48 and this assessment emphasises those risks that could theoretically threaten the Group’s ability to operate, or to continue in existence (with the VR designation). The assessment period The Directors have assessed the viability of the Group over the three year period to May 2024, as this is an appropriate planning time horizon given the speed of change and customer demand in the industry and is in line with the Group’s strategic planning period. Assessment of viability The viability of the Group has been assessed taking into account the Group’s current financial position, available bank facilities, and the Board approved FY22 budget and three year strategic plan. The Directors have produced a budget for FY22 which reflects the anticipated trading levels in the current environment and years two to three of the strategic plan represent the expected trading growth over this period factoring in the initial planned growth in the budget. The Directors have also assessed the viability of the Group taking into account the current financial position, including the recent acquisition of the Intellectual Property Management division of Iron Mountain and the associated new equity issue and additional debt taken on to fund that acquisition. The Directors have also modelled the impact of certain severe but plausible scenarios, which have the greatest potential impact on viability in the period under review, as set out in the table below. In particular, the Directors have considered the potential impact of additional Covid-19 related economic disruption on both the short and long-term growth prospects for the Group in a number of different scenarios, the potential impact of Covid-19 on customers and the associated impact on the Group’s performance, as well as the Group’s ability to execute its strategy. The impact of these sensitivities has been reviewed against the Group’s projected cash flow position, available bank facilities and compliance with financial covenants over the three year viability period. Should these occur, mitigating actions would be required to ensure that the Group remains liquid and financially viable, which include a reduction of planned capital expenditure, freezing pay and recruitment and not paying a dividend to shareholders, all of which are within the Directors’ control. Conclusions Based on these severe but possible scenarios, the Directors have a reasonable expectation that the Group and Company will be able to continue in operation and remain commercially viable over the three year period of assessment. Scenario Associated principal risks and uncertainties Description and potential impact Business strategy Attracting and retaining appropriate colleagues’ capacity and capability Failure to deliver the Securing Growth Together transformation programme. Loss of key colleagues or inability to attract and retain key talent. The potential impact of the above would act as a barrier to future growth. A critical systems failure, leading to an inability to provide services to customers. The potential impact of this would be short-term reputational damage and an inability to do business in the short term, impacting revenue and profits. A cyber security breach occurs with theft of data and disruption to business services. The potential impact of this would be long-term reputational damage significantly impacting future revenue. The world was victim to a global pandemic of Covid-19 in early 2020. Most affected countries were locked down for a minimum of six weeks and the economic disruption is still ongoing. The potential longer-term impact of this would be loss of jobs due to loss of revenue. There would also be reputational damage if there was a cyber security breach due to the remote working we have put in place to safeguard our people. Systems failure Availability of critical information systems Cyber risk (including data protection) Cyber risk (including data protection) Global pandemic – Covid-19 Cyber security breach Covid-19 (over and above base case short- term impact) 48 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 INSIGHTS: STAKEHOLDER ENGAGEMENT Leading reform through stakeholder engagement Katharina Sommer Head of Public Affairs Our public affairs function is focused on creating a conducive political and regulatory operating environment to improve cyber security policies, so they materially improve the cyber resilience for our customers and broader society (see pages 50 to 52 for more on stakeholder engagement). Nowhere is this demonstrated better than in our continued efforts to reform the UK’s Computer Misuse Act 1990, to enable cyber security professionals to undertake this critical work without fear of prosecution and unleash their full potential in making the world safer and more secure. As founding members of the CyberUp Campaign 1, we brought together peers from across the cyber security industry alongside trade associations, incubators, academics and parliamentarians, all of whom believe that UK cyber crime laws should not inadvertently criminalise the very same people seeking to keep the nation safe and secure. This campaign approach paid off, when, in May 2020, UK Home Secretary, the Rt Hon Priti Patel MP, announced that “now is the right time to undertake a formal review of the Computer Misuse Act” 2 and launched a call for information to assess if the law remained fit for use following the technological advances since its introduction in 1990 3. The campaign, driven by an evidence-based, pragmatic approach, considers the operational realities of cyber resilience in modern day society. The security of the internet and our digital world is strengthened by the work undertaken by security and threat intelligence researchers who help us identify and fix weaknesses, to stay one step ahead of our adversaries. Our vulnerability assessments of smart doorbells, for example, demonstrated attackers would be able remotely to control some devices, further highlighting the importance of good security practices in developing Internet of Things (IoT) products, and our research into a cyber threat group showed its preference for abusing cloud services in its operations, enabling us to help organisations improve their detection of and protection against future attacks. We will continue working with all our key stakeholders to create a reformed law that adequately protects security and threat intelligence researchers. 1 https://www.cyberupcampaign.com/. 2 3 https://www.gov.uk/government/speeches/home-secretary-priti-patel-speech-to-cyberuk-conference. https://www.gov.uk/government/consultations/computer-misuse-act-1990-call-for-information. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 49 Strategic reportStakeholder engagement continued Consistent and authentic engagement We believe by understanding and meeting the needs of our stakeholders, we will secure long-term success. This is achieved through consistent and authentic engagement. Here we have highlighted our key stakeholders, their identified needs and how we have engaged with them. Engagement of each stakeholder is done so with the NCC Group values at the heart of everything we do. We recognise the importance of listening to and understanding the views of our key stakeholders. We use insights to support our approach, addressing opportunities to build enduring and trusted relationships. Insights are gathered during our day-to- day business and are used to improve decision making at every level of the organisation – from the Board down to operations. Section 172 statement Section 172 of the Companies Act 2006 requires a director of a company to act in the way they consider, in good faith, would most likely promote the success of the company for the benefit of its members as a whole but having regard to a range of factors set out in section 172(1)(a)–(f) in the Companies Act 2006. In discharging our section 172 duty, we have regard for these factors taking them into consideration when decisions are made. Examples of how our Directors have oversight of stakeholder matters and have regard for these matters when making decisions are set out on these pages. Colleagues We are a people business and our 2,000+ colleagues around the world each have an important role in helping to make the world safer and more secure. The opportunity • Understanding our mission, vision, values and strategy • Understanding what is expected of them and knowing how they are contributing to our success • Spending quality time with their line manager, feeling listened to and supported, enabling them to feel confident they have the skills to be successful in their role • Feeling they are welcome to bring their whole selves to work How we listen and engage • Global internal news platform, which gives colleagues the option to keep up with what’s happening around the Group. Built using the Dynamic Signal platform, colleagues can share approved content with their social networks directly at the touch of a button • Online knowledge hubs to support consistent ways of working and make it easy for colleagues to understand requirements of their role • Knowledge sharing events – locally, regionally and globally • ExCom-led engagement at the local level, targeted as appropriate for different colleague groups, which includes colleague forums and, in Europe, Works Councils • Annual colleague engagement survey with local teams empowered to drive actions to continue to make NCC Group a great place to work • Non-Executive Director regular engagement sessions hosted with colleagues (see page 80) 2020/21 highlights • Hosted a virtual sales conference and our flagship technical event – Not the NCC Con – went virtual too, showcasing both our technical and professional brilliance over a three day period. We were joined by distinguished external speakers from the infosec world and business as well as Lord Chris Holmes, a supporter of the UK Computer Misuse Act reform campaign • Launched our first ever global team and individual awards programme (page 66) • Launched our inclusion and diversity engagement programme – NCC Conversations (page 55) • Continued to invest in our colleague wellbeing programme, which included partnering with This Can Happen, as well as creating a global network of trained Mental Health First Aiders, and training managers in mental health awareness to help build resilience throughout the organisation • Welcomed our new colleagues who joined us from the IPM acquisition • Continued to invest in colleague engagement, with significant improvement being seen in how colleagues feel about management, which represents the investment we’ve made over the past 12 months in management and leadership development Covid-19 action • Made provision for longer-term working from home with physical and mental wellbeing programmes put in place • Created a system to support colleagues with urgent needs to access alternative places to work where home working was not conducive to a positive working environment Link to strategy: Lead the market Win business Deliver excellence Support growth Link to strategy: Develop our people 50 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Customers Shareholders NCC Group is committed to engaging with our shareholders through continued sufficient and effective communication. The opportunity • Financial performance • Dividend • Sound long-term sustainable strategy • Sound corporate governance and stewardship How we listen and engage • CEO and CFO regularly meet investors • Investor roadshows after the full and half year results • Chair meets investors on an annual basis • Open door policy with investors • The AGM (and this year a general meeting to support the IPM acquisition) 2020/21 highlights • All resolutions (with the exception of the Directors’ Remuneration Report) passed at the 2020 AGM with at least 81% of votes for, with over 70% of the issued share capital voting • Further engagement with investors following the significant vote against the Directors’ Remuneration Report at the 2020 AGM • Consultation with shareholders on a new 2021–2024 Directors’ Remuneration Policy • 100% shareholder vote in favour of IPM acquisition • All Directors attended the AGM and were available to answer shareholder questions • Brokers and financial PR firm presented to the Board • Regular reports to the Board on investors and their feedback The past 12 months have seen threats turn into impacts across all markets. Our solutions continue to help to keep our customers’ businesses secure and operational. The opportunity • Using our global understanding of the risks and our customers’ operational challenges • Developing “right-fit” solutions which improve and enhance our customers’ cyber resilience • Bringing our technical investment into solutions beyond what non-cyber business can do • Ability to work collaboratively with them, their partners and supply chains How we listen and engage • Active account management • Regular client surveying and management feedback loops • Increasing investment in research to understand and mitigate risks across a wide range of current and future technology and industries 2020/21 highlights • Launched our Partner Network, initially for UK Software Resilience, expanding the offering through software vendors and helping them support their customers and scale their businesses • Partnered with SURF, the cooperative association of Dutch educational and research institutions, to provide 24/7 security incident and event management (SIEM) and security operations centre (SOC) services over the next five years • Achieved global partner “co-sell readiness” with Microsoft on Azure Sentinel. This opens up a marketplace for MDR where customers can use our expertise and achieve their cyber resilience via their Microsoft Azure technology • Enhanced our support to the increasing need for security assessments by becoming an approved provider for Google and Facebook third party app developer programmes such as ioXt Authorise Lab, Google OAuth API Verification, Facebook Workplace Security Review and Alexa Built-in Devices Authorised Third Party Lab and others • The Escrow division rebranded as Software Resilience – strengthening its proposition to support customers in achieving broader resilience of their critical software • The acquisition of Iron Mountain’s Intellectual Property Management (IPM) division significantly grows the US customer base and allows us to support them with a broader set of services Covid-19 action • Continued successful delivery through remote working and maintained a “working together” approach to match our customers’ challenging needs through the impact of local restricted working practices Link to strategy: Link to strategy: NCC Group plc — Annual report and accounts for the year ended 31 May 2021 51 Strategic reportStrategic reportStakeholder engagement continued Suppliers Our network We engage with a large number of different suppliers across our global business. Historically, we have had a very local and transactional relationship with suppliers; however, to enhance our competitiveness and remain agile, we are developing more formalised and sustainable relationships with our key suppliers based on both spend level and risk profile. The opportunity • Long-term trusted partnerships facilitating real, sustainable overhead cost reduction and cost of sale margin improvement • Strong working relationships • Fit for purpose contracts and payment terms, ensuring suppliers deliver to acceptable service levels and protecting NCC Group from any long-term commercial inflation • Ensuring we have a safe supply chain to protect our service delivery to customers and brand reputation How we listen and engage • We now have a small professional, dedicated and experienced procurement function which actively manages key suppliers, monitors supply chain trends and supports the business units to achieve their commercial targets • Regular meetings to be held with key suppliers to better inform them of NCC Group’s strategy and future forecasting • Due diligence completed at the beginning of our relationship with suppliers • Intention to host a supplier conference (post-Covid-19) • Supplier “Code of Conduct” launched to provide clarity around NCC Group’s expectations of our supply chain 2020/21 highlights • Delivery of substantial cost savings to support the businesses growth strategy • Significant restructure of NCC Group’s global estate portfolio to support the expected new ways of working, post-Covid-19 • Introduction of risk-based analysis of NCC Group’s supply chain to provide valuable insight supporting the Company though the significant changes due to Brexit and Covid-19 • Proactive communication of the Source to Pay Policy which underpins NCC Group’s relationship with its supply chain • Consistently engaging other business units and corporate functions to recommend, based on experience, internal efficiency improvements to drive clearer planning and spend reporting NCC Group is committed not only to creating a conducive operating environment to enable our long-term growth ambitions but to using our expertise to inform evidence-based policy making and improving the resilience of our societies. The opportunity • Our expertise, capabilities and global footprint allow us to offer solutions to modern society’s cyber challenges • Educating policymakers and regulators • Providing access to basic cyber knowledge to those organisations that are vital to their local communities • Sharing opportunities to experience the world of cyber and inspiring the next generation How we listen and engage • We work in partnership and build alliances with like-minded and trusted organisations – from global think tanks and foundations, to trade associations, charities and campaign groups – to pool resources, amplify our messages and maximise impact • We support initiatives by governments and public bodies where we have shared objectives, such as the UK government’s CyberFirst skills programme, work with schools and universities to offer mentoring and industry support, and maintain strategic relationships with national technical authorities across all of our regions • We undertake direct engagement and advocacy to share our expertise with regulators, officials and politicians grappling with the challenges of emerging technologies and keeping their citizens safe in an interconnected digital world 2020/21 highlights • Campaigned forcefully for better legal protections for the crucial work of security and threat intelligence researchers around the world, as a founding member of the CyberUp Campaign in the UK that brings together cyber security professionals, technology firms and start-up incubators alike, and has seen the UK government undertake a formal review of the Act, and as a member of the Open Source Security Foundation (OSSF), to press for security research exemptions in the US Digital Millennium Copyright Act (DMCA) • Supported the UK National Cyber Security Centre’s (NCSC) CyberUK flagship conference for the fifth year running and delivered the NCSC Cyber Security PhD Winter School virtually allowing academics, industry and government to connect; offered remote work experience to pupils, students and interested parties from law enforcement; and concluded the first year of partnership with the Small Charities Coalition which helped to build the cyber resilience of up to 12,500 charity employees, trustees, volunteers, beneficiaries and service users • Joined the UK’s Cyber Growth Partnership; became part of the UK Department for Digital, Culture, Media and Sport (DCMS) Secure Connected Places External Advisory Group; educated global financial regulators, from the Financial Stability Board to Canada’s OSFI, on the benefits of technology and software escrow agreements in supporting operational resilience objectives; and worked with the UK Industry & Parliament Trust to continue giving parliamentarians an insight into the day-to-day realities of cyber resilience, and with the Linux Foundation in the United States to educate Congressional staffers on workable policy solutions to high profile technology challenges Link to strategy: Link to strategy: 52 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Sustainability Making the world safer and more secure for all NCC Group’s commitment to sustainability is integral to how we do business – simply it is our licence to operate. Grounded in our values and principles, we’re guided by our Code of Ethics and driven by our mission to make the world safer and more secure for our people, our customers, our investors, and the communities we live and work in. As society’s dependence on the connected environment and its associated technologies increase, we use our global insights to help organisations assess, develop and manage their cyber resilience posture, enabling them to confidently take advantage of the opportunities that sustain their business growth. We draw on our expertise, capabilities and global footprint to develop solutions to meet current and future cyber challenges. We help to educate policymakers and regulators. We give back to protect our local community services and we share opportunities to experience the world of cyber and inspire the next generation to secure our future. Read more on our business model on pages 20 and 21 Read more on how we manage and monitor risk in relation to sustainability on page 47 Our approach to sustainability is focused on the recognised elements of environment, social and governance (ESG). These are brought to life with our framework, which enables us to focus our efforts on the activities that deliver the greatest value to our people, our customers, our shareholders, and the world we all live in. We will set objectives that consider people and the planet, and we will hold ourselves to account through our annual reporting cycle and through regular stakeholder engagement. Yvonne Harley Global Director of Sustainability and Corporate Affairs NCC Group plc — Annual report and accounts for the year ended 31 May 2021 53 Strategic reportStrategic reportSustainability continued Our key sustainability focus areas and objectives Efficiency Community engagement Climate change Respect our environment T M E N N O IR V N E S O C I A L Focus areas and objectives Wellbeing Inclusion, diversity, skills and development G OVERN A N C E Good governance enabling investment, innovation and sustainable growth Responsible supply chain Quality services and satisfied customers Environment Social Governance • This is a priority area for us to focus on in this new financial year • Building on the new and successful ways of working created by the pandemic we will engage in conversation with our customers to explore how we can work together to reduce the impact on the environment through reducing non-essential travel • As our office environments come back to life, we are investing in education programmes to reduce our physical impact – from flexible working and minimising printing, to increasing recycling. And we will continue to review our physical office requirements to ensure we only use what we need • We’ll design solutions for the future, driving efficiency into our design and delivery • We have partnered with Willis Towers Watson to develop our approach to identifying and assessing climate change risk, which will support the development of a robust strategy and enable reporting against the Task Force on Climate-Related Financial Disclosures (TCFD) in 2022 • We continue to foster partnerships that support development of future diverse cyber talent • Building on the development of our pilot programme in the UK (in preparation for lockdown restrictions easing) we will develop a global giving back programme, which will enable colleagues to take part in local community programmes • We will continue to invest in developing our mental health first aid network and resources and look to implement our broader wellbeing strategy, partnering again with This Can Happen • Through NCC Conversations we will continue to encourage engagement from colleagues and our external stakeholders around our four focus areas of gender, LGBTQIA+, race and ethnicity and neurodiversity. Our signing of the UN Global Compact will reinforce our commitment to our responsible business operations • The conversations alongside our performance management programme and career framework development will help drive our performance culture, creating an environment where everyone is welcome and can be successful • We continue to be committed to building long-term sustainable relationships, earning trust through understanding the challenges our customers have and delivering high quality solutions to take their pain away • We will win business fairly and use our internal processes to assess and consciously accept working with customers who align with our own values and Code of Ethics • We will strengthen our Supplier Code of Conduct to ensure we protect the integrity of our ethics across the supply chain, entering any supplier or partner relationships with a mutual understanding of each other’s code of ethics and general business policies • We will provide accurate and timely information to shareholders and always observe the relevant regulations and corporate governance principles to protect the integrity of our business operations • We will consider the interests of all our stakeholders when we make decisions on the Group’s future strategy and priorities 54 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 How we will measure our commitments In FY22, we are conducting a Responsible Business Tracker with the UK’s Business in the Community organisation. This will provide us with a detailed report of how we are performing and coupled with recent investment ratings feedback will support us to identify longer-term sustainability targets. In the interim, in FY22, building on our work to date we aim to: • Report against the Task Force on Climate-Related Financial Disclosures (TCFD) • Establish our local office champion network and provide training and toolkits to support responsible business practices in line with health, safety, security and environment requirements • Create an Accessibility colleague resource group, to look at inclusion across everything we do – from websites, to our offices and working off-site – through multiple lenses, always seeking to improve how we operate • Measure our travel behaviour and understand the impact on the environment and how we can improve/offset, with an aim to reduce activity by 30% based on FY19 (our last full year of travel pre the pandemic) by: • Continuing to host routine meetings virtually where it makes sense to do so • Embracing flexibility, family friendly policies and remote working • Piloting a new pricing model in our UK Assurance business to help customers understand the environmental impact of on-site delivery versus remote delivery • Continue to increase the diversity of our workforce by establishing partnerships and ensuring our focus on creating an environment where everyone feels welcome: • In FY21, 29% of all hires (where gender was disclosed) were female, with an increase of 43.5% on actual female hires compared to FY20; in FY22 we commit to achieving the same or better through our targeted efforts and working with hiring managers to realise the value of difference • Establish partnerships in the UK and North America to support our early careers programme, with a focus on underrepresented groups • 100% of eligible colleagues undertake compliance training covering Code of Ethics, Inclusion and Diversity, Anti-Bribery and Corruption, Data Privacy and Data Protection and Information Security • Launch our Action Ally programme, led by the Gender colleague resource group, to educate and inspire 100% of our colleagues to be inclusive every day Reflections on the past year While technology was able to break (in part) the barrier of isolation caused by the global pandemic, there was also a risk of it becoming a barrier as fatigue and frustration started to creep in. We know from our engagement with other organisations we weren’t unique, and we took action to mitigate the risk to our Covid-19 survive and thrive strategy. We continued to focus on the health and wellbeing of colleagues – prioritising the training of a global network of 61 Mental Health First Aiders and training over 100 managers in mental health awareness and supporting wellbeing, building resilience through a series of engagements throughout the organisation. We also launched our NCC Conversations programme to support engagement around our four inclusion and diversity priorities (page 62) – gender, LGBTQIA+, race and ethnicity and neurodiversity. The conversations, hosted through panel sessions, articles, workshops and podcasts, have led to positive changes in how we operate as a firm. NCC Conversations is such a great initiative and, although we are all remote working, it feels like this has somehow brought us closer together. Holly Duncalf Project Manager Our focus on inclusion and diversity is sustained through embedding insights for dialogue, and local target setting into our monthly executive business reviews and is a key priority in our growth strategy. We continued to reduce complexity in our business, reducing our legal entities, combining our Benelux and Danish entities to create one powerful European business and creating a global operating committee to unify how our professional and managed services operate in service of our customers. This not only increases our ability to attract a wider and more diverse talent pool but also reduces the risk of regional talent challenges affecting our ability to deliver for customers. In the ever-increasing connected society, cyber resilience is important and should be part of responsible business practice – from design to operations. As a major player in the cyber resilience market, we have a responsibility to apply our world-class research skills, market knowledge and threat intelligence to ensure we design products and services that support our customers to meet their whole cyber resilience posture requirements. This is the driver of the progress towards our vision to be the complete global provider of cyber resilience solutions within a growing global market and evidenced with the launch of new propositions to meet this requirement. Partnership for the goals We review partnerships on an annual basis with a view to ensure they continue to be of value. In the past year we became members of the UK’s Business in the Community programme, undertaking its Responsible Business Tracker assessment to support our future sustainability plans. In this new financial year, we have become members of the United Nations Global Compact, with full Board and CEO endorsement to embed its principles into our strategy, culture and ways of working. More broadly, our active network engagement and industry partnerships help us to further support the United Nations Sustainable Development Goals, build global cyber resilience and help make the whole world safer and more secure. Investing in a sustainable future Our commitment is to create an environment where all colleagues feel psychologically, emotionally and physically safe to be authentic and representative of the diversity of the world they live in, to share their personal experiences and to have equal opportunity to achieve. We want to drive the focus globally but empower local action ensuring that we reflect and embrace our differences. This commitment influences our partnerships, how we recruit and how we deliver value to our customers. We will continue to secure the future today and our sustainability agenda will play a strategic role to support conscious decision making as we begin to set targets that challenge us to continually improve in making the world safer and more secure for all. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 55 Strategic reportStrategic reportw Sustainability continued Aligning to the United Nations Sustainable Development Goals for best practice The United Nations Sustainable Development Goals provide us with a blueprint to achieving a better and more secure future for all. We selected the following goals, which we felt were most relevant to our business and to our stakeholders: Our Sustainable Development Goals 3 – Good health and wellbeing Through our threat intelligence and cyber resilience solutions, we are helping to secure the technology for increasing and protecting the provision of health services globally. 4 – Quality education We are focused on investing in the future of cyber security skills, developing not only career frameworks and pathways for research, but also helping to protect the technology, which gives access to education. 5 – Gender equality and 10 – Reduced inequalities We are committed to building a diverse and inclusive culture, for our colleagues and our customers. We are focused on equality, creating an environment where everyone is welcome and can be successful. 8 – Decent work and economic growth We are a global business, with local hubs, attracting and developing diverse talent – from early careers to senior experts – all to support the global need for cyber resilience skills. 9 – Industry, innovation and infrastructure and 17 – Partnerships for the goals Our commitment to research, vulnerability disclosure and threat intelligence and the industry partnerships we foster help to provide safe and secure by design technologies, which enable industrialisation and innovation to drive future developments. 13 – Climate action As well as our own ambition to reduce our carbon footprint, working with our customers we will seek to contribute to reductions in global greenhouse gas emissions through continuing to develop remote solutions. 16 – Peace, justice and strong institutions Our value proposition is based on trust and this is founded on our Code of Ethics, considering the interests of all our stakeholders when we make decisions on the Group’s future strategy and priorities. 56 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Environment Out of 207 company cars (the UK and Netherlands): 61 are fully electric 113 are other 33 are hybrid 78 Average CO2 emissions of our company car fleet Greenhouse gas emissions The greenhouse gas (GHG) reporting period is aligned with our financial reporting year running from 1 June to 31 May. The reported figures detail annual GHG emissions from activities for which NCC Group is directly responsible. Having considered the production metrics within the business, we have concluded that annual turnover is the most appropriate to achieve a benchmark, which aligns with the carbon reduction policy and methodology that we will work towards in FY22. The methodology used to calculate total energy consumption and carbon emissions has been through the extraction of consumption data from invoices and meter reads for the financial years stated. Where data was not available, estimates have been calculated using historical profiles and details held on record by the Group’s Compliance department for audit purposes. Energy and fuel consumption has been expressed in tonnes of carbon dioxide equivalent (tCO2e), using 2019 DEFRA published conversion factors. Fuel for transportation has been converted using statistical data sets published by the UK Department of Transport. The overall energy and carbon report was produced by PEP Energy, an independent third party that analysed invoices from energy suppliers and data from expense systems to calculate the overall results. Pandemic considerations Over the past year, we’ve had little use of our global office space due to pandemic restrictions and we’ve also reduced our office footprint so comparing like for like is not possible. Our calculations do not consider the impact of our colleagues working from home and the increase of their domestic energy use or decrease of their commuting over the full year. We are continuing to seek expert advice on how this can be measured to enable us to truly reflect the CO2 emissions of our organisation as we continue to operate in a more flexible environment in the future. Energy performance benchmarking In FY22 our aim is to reduce carbon intensity for the Group and, working with our key stakeholder groups, we will set out targets, which will minimise the impact of our operations on the environment. Due to the size and nature of NCC Group, an external environment audit is not required; however, we will continue to assess this as the Group grows in conjunction with any legislative developments. Electricity: 65.63 Emissions by type % Air: 6.42 Gas: 17.62 6+ Electricity (tCO2e) Petrol: 5.32 Diesel: 5.00 345 415 298 2018/19 2019/20 2020/21 Gas (tCO2e) 63 61 80 2018/19 2019/20 2020/21 Diesel (tCO2e) 187 122 23 2018/19 2019/20 2020/21 Petrol (tCO2e) 122 64 24 2018/19 2019/20 2020/21 Air (tCO2e) 611 222 29 2018/19 2019/20 2020/21 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 57 Strategic reportStrategic report66 + 5 + 5 + 18 M Sustainability continued Environment continued Source Scope 1 Gas Company vehicles Diesel Petrol Total scope 1 Scope 2 Electricity Total scope 2 Total scope 1 and 2 Scope 3 Business travel Total scope 3 Total scope 1, 2 and 3 Underlying energy use The table below shows the proportion of Scope 1 and Scope 2 energy use that occurs in the UK and non-UK countries alongside the total carbon emissions. In FY21, 45% of the Group’s energy consumption and 72% of carbon emissions arose from the UK. Area UK Non-UK 1,436,210 1,780,945 Total 3,217,155 FY21 energy use FY21 carbon emissions KwH % of global energy use tCO2e % tCO2e 45% 55% N/A 305.003 119.577 424.58 72% 28% N/A Task Force on Climate-Related Financial Disclosures (TCFD) We recognise the importance of identifying the financial and non-financial impacts of climate change on the business. To make more informed financial decisions, we and our investors, lenders and insurance underwriters need to understand how climate related risks and opportunities are likely to impact our future financial position. A robust approach to assessing climate change risks and opportunities will support us to develop business strategies, which will support future sustainability and growth. While we are not required to report against TCFD requirements this year, we recognise the importance of this initiative and how it aligns with our wider ESG agenda. We have established a partnership with Willis Towers Watson to further develop our approach to identifying and assessing climate change risk, which supports the development of a robust strategy. The model to achieve this is shown opposite. Total GHG tCO2e 2019 2020 2021 63.11 185.83 121.98 63.85 61.35 309.42 187.27 122.15 79.96 46.83 22.68 24.15 248.94 370.77 126.79 345.43 415.32 345.43 415.32 594.36 786.09 222.32 611.17 222.32 611.17 297.79 297.79 424.58 29.14 29.14 816.68 1,397.26 453.72 tCO2 change from previous year (2020 and 2021) % change from previous year 19 (263) (165) (98) (244) (118) (118) (362) (582) (582) (944) 30 (85) (88) (80) (192) (39) (39) (85) (95) (95) (68) UK cycle to work scheme In April 2021 we enhanced the benefit allowance, in line with the UK government’s cycle to work scheme, from £1,000 to £6,000 for colleagues living in the UK and using a bike to commute to work. Colleagues can purchase a bike and equipment through this organised salary sacrifice scheme and the increase was made because of their feedback in our colleague forums and annual engagement survey. This enhancement is part of our overall wellbeing programme and commitment to reducing the impact we have on the environment. Secure leadership buy-in Establish committee oversight Audit Com mitte e Integrate into reporting Assess financial impacts Ris k C o m m i t t e e Perform scenario analysis Adapt ERM Obtain assurance Implement internal control Collaborate across the business Use existing tools Solicit investor feedback 58 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 At the very start of the pandemic in early 2020, an important consideration for organisations around the world was how they were going to function as restrictions impacted their traditional way of working. With remote working becoming the norm, trust was required to make it work. Product development – designing today for the future We are committed to building new products, which support our sustainability commitments and meet our customers’ current and future needs. Our product development ethos is to improve our end-to-end product design and build processes, ensuring we design with sustainability in mind, purposely and continuously. This approach enabled us to be agile in adapting many of our products to be purchased, deployed and implemented remotely, ensuring we could support our customers as they moved to remote/ hybrid working models due to pandemic restrictions. (An example of this is our Firebase appliance illustrated opposite.) Another critical element of our design approach is to ensure our product offerings are accessible. Our new Calibrate platform, which offers intelligent data-driven cyber resilience dashboards to guide risk strategy, is a great example of this. The platform was purposely designed to support user accessibility for those with the visual impairment of colour blindness. This inclusive design provides high colour contrast visual aids to support the interactive engagement between users and the Calibrate platform. We listen to our customers, ensuring their voice is represented in the products we take to market. S t r a t e g c i r e p o r t Firebase With 80% of the work we traditionally do for customers already being delivered remotely, one area that is often overlooked is routine security testing. In 2018 our consultants developed an appliance – Firebase – that would enable remote security testing to be conducted – a great example of designing for the future. From the early prototype, NCC Group’s Nick Watkins developed the current appliance as a research project supported by Simon Beattie. Their current version can be downloaded or posted and provides our customers with a credible and necessary alternative to ensuring their systems were secure. Initially launched in the UK, and later in North America and our APAC region, the Firebase appliance is being developed and used to support our incident response teams as well as being planned for use by our European business. Between 1 April 2020 and 31 May 2021, we conducted 761 jobs using Firebase, which equalled 11,656 days of remote working, and with an average of a 45–50 mile round trip from a consultant’s home to customer premises, we reduced our travel impact by c.500–600k miles – the equivalent of 20–25 times around the world. We will continue to engage with customers and encourage continued deployment of security testing remotely to improve efficiency for their business and remove unnecessary travel, which has a negative impact on climate change. We design today for the future, working in collaboration with our colleagues across the Group, understanding the whole needs of our customers and ensuring our product offerings are accessible by all. Michelle Barry Director of Product and Development NCC Group plc — Annual report and accounts for the year ended 31 May 2021 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 5959 Strategic reportStrategic report Sustainability continued Social Each day at NCC Group our technologists and professionals wake up with one mission – to help make the world safer and more secure. Together they form a phenomenal knowledge network, collaborating, innovating and delivering value to our customers. This culture is important to us and we strive to create a great place to work, a place where everyone is welcome and can be successful. We are guided by our Code of Ethics – treat everyone and everything with respect; our common values are: We work together No matter how brilliant an individual might be, they are no match for a team. Our best and most impactful work has always resulted from collaboration. We act in the best interests of the whole Group and we never miss an opportunity to help each other and our customers. We exist to help keep our customers safe and secure – the better we understand our customers and their values, the better we can help them thrive. So, we work closely with our customers too. We are brilliantly creative We like to win. We like to, and we are good at, solving hard problems. We work hard but, in our world, success does not just come from hard work – it comes from looking at things differently and never being satisfied with the way things are. In being brilliantly creative, we need to work together – we expect collaboration, innovation, and diversity, which brings us onto our third value… We embrace difference The ability to think in a different way (to, for example, how systems were intended to be used) is what leads to much cyber vulnerability and is the cornerstone of the security testing and risk work we do. So, we work together, we are brilliantly creative and: • We welcome and actively seek out diversity in our thinking and in our internal representation • We seek constructive challenge as we gather information before making a decision • We want to keep our quirky and distinctive culture (unusual in an attractive and interesting way) Listening to colleagues During the past year, we continued to improve how we listen to colleagues both at a global and a local level. We created a monthly team engagement pack for managers to talk to their teams about various aspects of our business – all with the aim to ensure we kept connected to our mission, vision, values, and strategy despite the isolation of the pandemic restrictions. These monthly sessions encouraged teams to talk, explore and feed back – not just about our business operations but also how they were feeling. From those conversations we recognised the opportunity to create a global people managers’ forum to support them to manage the drivers of engagement – it enables them to get closer to their local executive member and our HR team has created a dedicated resource centre to further support people managers and to improve how we listen at every level of the organisation. Building on the UK colleague forum pilot launched in the previous year, we extended the colleague forums to our operations in Spain, Australia, Singapore and Japan and our Global Software Resilience business and Group functions, and we launched a new Works Council for colleagues in Denmark alongside our existing Works Council in the Netherlands. We ran our annual b:Heard employee engagement survey with Best Companies, increasing our response rate to 81.85% (up nearly 2%) on the prior year, and continuing to improve our colleague engagement score to 642.7 (626.9 in 2019). While still within Best Companies’ index of “one to watch” companies, through robust local and global action planning and active listening we strive to match our world-class participation rate with a world-class engagement score of 3*. The investment in our Manager Essentials programme can be seen in the results from our engagement survey where 77% of eligible managers were recognised by their teams: Good Very good Outstanding World class 20.5% 18% 18% 20.5% Jennifer Duvalier, our designated Non-Executive Director for colleague engagement, continued to meet with colleagues around the world virtually, extending our listening ability, and you can read more about her experience on page 80. Regular town hall events and the creation of virtual communities using Microsoft Teams gave more opportunities for us to improve how we listen and learn through our day-to-day operations. Visible leadership played a critical role in this improvement and even more so due to the continued isolation of colleagues due to the ongoing pandemic restrictions. 60 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Investing in personal development Our ambition is to be known as a hub for cyber talent, a place where people can come and develop personally and professionally. In FY21 we: • Launched a sales academy pilot in our UK and APAC Assurance division, which provides structured training to support sales colleagues at every stage of their career – from joining NCC Group through to advance sales techniques • Began to build leadership development, with 40 North American leaders undertaking the Stanford Leadership Development programme with over 180 managers globally attending our Manager Essentials programme • Extended investment in developing our next generation managers and 22 colleagues in the UK and North America due to graduate in September 2021. All colleagues from the pilot cohort in FY20 went on to be promoted to managerial roles In addition, listening to feedback from our colleague forums and engagement survey, we launched our career framework pilot in March 2021. The initial focus for the pilot is our technical community in our Global Professional Services in the UK and APAC region. The aim is to clarify how colleagues can progress from junior through to senior levels and how to move across specialist and management roles, with a view to empowering them to manage their own career. The career framework will include: • A toolkit to help colleagues plan potential career steps/paths across the role options • A learning catalogue linked to roles, with details of how to access learning • Optional career development workshops for colleagues • Regular career development discussions as part of our performance management process • Clarity on our approach to promotions The pilot will extend to other parts of the business including our Global Software Resilience, Global Managed Services and Sales colleagues over the coming year. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 61 Strategic reportStrategic reportSustainability continued Social continued Creating an inclusive and diverse community We want to create an environment where all colleagues feel psychologically, emotionally and physically safe to be authentic, representative of the diversity of the world they live in, share their personal experiences and have equal opportunity to achieve. Our inclusion and diversity plan underpins our growth strategy and in FY21 was focused on four areas that were identified as being important to our colleagues: • Gender • LGBTQIA+ • Neurodiversity • Race and ethnicity For each of these focus areas we have colleague resource groups led by a Steering Committee, each of which has an Executive sponsor, HR and a Talent Partner. A dedicated Group Communications Business Partner is responsible for supporting our colleague resource groups to drive engagement both internally and externally. At the heart of our commitment to inclusion and diversity is our NCC Conversations programme, which we launched in August 2020. Each month the focus area Steering Committees work together to produce content, from blogs to panel sessions and resources, which support our ongoing awareness and education for colleagues. In addition, the programme includes workshops with external experts invited to support learning around topics exploring what it means personally and in the workplace. What a journey we’ve been on over the past nine months. The content, the resources, the conversations and the personal experiences being shared, alongside the feedback we’ve received both internally and externally, have been inspiring. Our NCC Conversations programme is a great example of our values in action. We work together, being brilliantly creative and embracing difference, and what connects us – what we all have in common – is our desire to make this a safe and great place for all. A highlight for me was when a colleague said: “Had I ever before today come out as a transvestite in the workplace? Well, I never had. This is a first for me and it is indeed a big step. So why did I feel the need to do it? It is because of our inclusion and diversity programme that I felt like it was no longer a matter of why, but why not.” Chloe Kersey Communications Business Partner and NCC Conversations lead Inclusion and diversity engagement FY21 highlights 4 colleague resource groups: Race and Ethnicity, LGBTQIA+, Neurodiversity and Gender 36 13 external guest speakers 15 Steering Committee members across the four groups articles published externally (newsroom.nccgroup.com) 90 inclusion and diversity community members 6 Executive sponsors 20 Instagram posts 90 pieces of content shared internally 1/3 of colleagues attended at least one workshop 250 average workshop attendance Read more online: www.nccgroupplc.com 62 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 These conversations are leading to positive changes in how we operate as a firm – investing in annual inclusion and diversity training as well as building into Manager Essentials training, partnering with organisations to develop future pathways for diverse talent to enter the industry, reviewing colleague policies, and improving how we recruit new talent and invest in career development. Gender pay gap * We take our role as a responsible employer seriously and see the UK requirement to publish gender pay gap figures as an important step towards transparency around a key issue within our industry. We recognise steps need to be taken to continually improve our gender mix at all levels as part of our broader strategy and the investment we are making under our broader sustainability commitment is supporting us to achieve this. Our full report is available to view on our website and in FY21, in addition to the work of our Gender colleague resource group, we continued to support local initiatives aimed at encouraging more women to enter the world of cyber security. * Source: NCC Group payroll data. Read more online: www.nccgroupplc.com/investor- relations/corporate-governance/gender-pay-gap/ Main Board 14% 40% 86% Direct reports to the Executive Committee 8686+ 6060+ 7676+ Group 76% 23% 60% 1% 80% 20% Executive Committee New hires in FY21 8080+ 6767+ 29% 67% 4% Male Female Undisclosed NCC Group plc — Annual report and accounts for the year ended 31 May 2021 63 Strategic reportStrategic report + 14 14 + + 0 0 + + 0 0 + + M M + 23 23 + + 1 1 + + 0 0 + + M M + 40 40 + + 0 0 + + 0 0 + + M M + 20 20 + + 0 0 + + 0 0 + + M M + 29 29 + + 4 4 + + 0 0 + + M M Sustainability continued Social continued Colleague resource groups – reviews from each chair Race and Ethnicity Nadia Batool Data Protection and Governance Officer LGBTQIA+ Liz James Security Consultant Neurodiversity Joy Evans Chief Data Protection and Governance Officer We are a global business with colleagues in many different countries around the world. We work hard to be an inclusive workplace, where everyone is treated with respect. Discrimination and harassment due to race or ethnicity are unacceptable and will not be tolerated here. But saying it isn’t enough, and like many companies addressing the systemic racism embedded in our societies, we are planning action to remove barriers for underrepresented individuals that exist within our organisation. Over the past nine months our Race and Ethnicity Steering Committee has covered key themes such as an introduction to race and ethnicity, and cultural intelligence, with guest speakers from North America and the UK discussing how to build an anti-racist organisation. We have also been working hard on providing colleagues across the Group with resources on inclusive language and behaviours and why representation matters as well as sharing personal and historic experiences of racism across the world. We believe that a workplace in which colleagues feel safe and empowered regardless of their sexual and romantic orientation, and their gender identity enables everyone to perform at their best. We are at the beginning of a long journey and committed to increasing our awareness and activity in this space to work towards creating an environment that provides inclusion for all underrepresented groups, ensuring their voices are heard. As the first colleague resource group in NCC Group, launched in 2019, we were delighted to be joined by the other groups to create a broader inclusion and diversity community. This year, our LGBTQIA+ Steering Committee has helped colleagues explore sexual and gender identity in its many forms, taken a deeper dive into the importance of inclusion and hosted talks on topics including how language matters, asexuality, being transgender and transvestism, as well as providing content based on personal experience and informative articles. Together we have utilised our social platforms to provide advice and support to parents of children who sit within the community, written to UK Members of Parliament to show our support against anti-trans bills, made pronoun badges available to colleagues across the globe and given guidance on adding pronouns onto email signatures. We strive to create a working environment where neurodiversity is embraced. We value all colleagues equally and adjust as necessary to meet the personal needs of neurodiverse individuals. The NCC Conversations series we’ve led has so far focused on both dyslexia and autism as a subcategory of neurodiversity, where the Steering Committee has been challenging taboos and taking a deeper dive into dyslexia and autism in the workplace through a range of activities including panel discussions, resources, tips for managers and a podcast on parenting an autistic child. Most recently, we’ve invited Lexxic, a specialist consultancy championing and advising on neurodiversity in the workplace, to run an interactive workshop with colleagues to produce a neurodiversity smart roadmap with recommendations and actions based on any gaps identified in our business. This workshop builds on an earlier webinar that was hosted as part of our NCC Conversations series. Neurodiverse individuals bring many strengths that not only need to be understood but further celebrated and valued. At NCC Group we are lucky to work with neurodiverse colleagues who bring many positive attributes to our workplace. 64 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Gender Natasha Gardner Technical Pre-Sales Engineer We recognise that gender inequality affects everyone across all genders. We want to provide opportunities for every colleague across the Group to be involved, to share experiences and to help set the vision for how we can work together in creating a more gender inclusive and diverse workplace. We are committed to ensuring that equal opportunities are presented across the Group. We will do this by constantly reviewing and improving our hiring processes and examining the channels we use for talent attraction and recruitment, at the same time as leading with an approach of inclusivity and fairness to promote career progression. Over the past year the Gender Steering Committee, working closely with our people team, has shone a light on mental and physical health with external talks on the menopause and prostate cancer, and internal panels on male mental health as well as publishing an external webpage celebrating some of the incredible women we have working here across the Group. Our recent project, Action Ally, aims to support and educate colleagues on what allyship looks like in certain situations through using examples of uncomfortable instances that colleagues have either experienced or observed throughout their careers in a bid to recognise and call out poor behaviour. We’ve also established NCC Group Women’s International Network (WIN), which is open to those who identify as women and are passionate about championing an inclusive and diverse workforce. We recognise that now, more than ever, it’s important for us all to pull together, as families, as colleagues, and as communities. Our giving back day is designed to help colleagues connect with and support local communities and causes that mean something to them. Ian Thomas Managing Director, Assurance UK and RoW Giving back in our local communities Through our annual engagement survey and local colleague forums, we know that giving back to our local communities is important to colleagues. Up until more recently these giving back activities have been informal and led entirely locally and colleagues were keen for us to create a more formal giving back activity while still retaining that local action. So last year, in preparation for pandemic restrictions lifting, we developed a pilot giving back programme with colleagues in our UK, Spain and APAC Assurance division. The programme enables colleagues to take one day of additional paid leave in a calendar year, to support a local community or charitable organisation. During FY22, the programme will be rolled out to the wider Group, ensuring compliance with local requirements relating to volunteering. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 65 Strategic reportStrategic reportSustainability continued Social continued Partnering with the UK Small Charities Coalition In 2019, we launched our partnership with the Small Charities Coalition, organising cyber resilience training workshops to give small charities the practical tools to improve their cyber resilience. In FY 2020, despite the challenges of the pandemic restrictions, we continued to invest in our commitment. Across four virtual workshops, offering ad-hoc advice, and the production of four easy to understand cyber security videos, more than ten colleagues invested over 40 hours to help make the world safer and more secure. 71 representatives from small charities across the UK, with an average annual income of less than £190,000, attended our virtual workshops: that means that, on average, the cost of a cyber breach 1 represents at least 1% of those charities’ annual income, highlighting the importance of improved cyber resilience for their future. Moreover, those charities play a fundamental role in their local communities and often work with vulnerable communities, or on sensitive issues, from addiction and mental health support, to supporting asylum seekers, veterans, disabled children or disadvantaged communities. 1 https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2021/ cyber-security-breaches-survey-2021. Northern Ireland Republic of Ireland Scotland North North East East Midlands West Midlands East Anglia Wales South West South East I found it so helpful to get a broad introduction about the main areas of cyber security while also getting lots of specific and practical tips about the many things I can do to make our charity as safe as possible. Workshop attendee Demonstrating the impact of our work, 80% of charity attendees said they felt better informed on cyber resilience issues and were very keen to implement their learnings. And their combined reach includes the more than 2,500 staff, volunteers and trustees who work with them, and the more than 28,000 service users and beneficiaries they support. Our support has extended to becoming a referral partner for the Small Charities Coalition helpdesk, so that callers with cyber security queries will be routed to our NCC Group experts. This builds on our work with the Federation of Small Businesses’ cyber advice helpline and the Scottish Business Resilience Centre’s cyber incident helpline. Celebrating our colleagues We launched our global NCC Diamonds and Stars awards in July 2020 to celebrate the incredible achievements of our colleagues – as they work together and as individuals. Our aim was to create a public platform where we could recognise colleagues and say thank you, as well as to shine a light on these achievements. It helps to instil a sense of pride and accomplishment and, importantly, the value we place on every colleague who every single day helps to make our world safer and more secure. Our team awards – NCC Stars – saw 68 entries highlighting contributions against each of our five nomination categories – Working Together, Being Brilliantly Creative, Embracing Difference, Delighting the Customer and Community Champion. Our global winners were announced in a virtual online ceremony – not allowing the pandemic restrictions to get in the way of our celebrations. Next up in February 2021 we launched our NCC Diamonds, inviting colleagues to nominate their colleagues. We received 498 nominations, which were judged locally, and winners of each category were given an “experience of their choice” prize. The local winners were then submitted to a global judging panel with our global winners being celebrated across the Group. Nomination categories: • Working together • Being brilliantly creative • Embracing difference • Inspiring colleague • Inspiring manager • Brand ambassador 66 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Global winners Working together Carla Strong Inspiring colleague Natasha Gardner Carla is the person you want to go to whenever you need some information or have a problem, or if you’re a fresh face at NCC looking for a little guidance. Along with mentioning her infectious positive energy, her nominators said that Carla is a fount of all knowledge on office administration, facilities management, delivery operations, and any other way she can support colleagues. Her commitment to ensure that everyone has support means she truly is an #NCCDiamond. Beyond her role as a Technical Pre-Sales Engineer, she is chair of our Gender colleague resource group, a Mental Health First Aider, a member of the UK Colleague Forum, and host of our internal podcast series, NCC Untitled. As her nominators said, she manages each of these responsibilities with an unfailingly positive attitude and puts her heart and soul into everything she does. Embracing difference Charlotte Tanner Inspiring people manager Ben Mitchell When her secondment to Sydney was prevented by the Covid-19 pandemic, she still took on the responsibilities of her new Business Partner role, despite being unable to relocate. This meant supporting the APAC team with long, unsociable hours across two time zones! Those who nominated her spoke of her appreciation of cultural differences and acknowledgement and respect of colleagues’ diverse perspectives on issues. This, combined with her flexibility, empathy, and commitment to going above and beyond, has resulted in several brilliant outcomes for her team. Ben Mitchell was recognised as the global winner of the NCC Diamonds inspiring people manager award for his caring, positive and empathetic attitude. Those who nominated him mentioned his genuine care for those he manages, his extraordinary support and encouragement, and his willingness to go above and beyond for those who need his help. Being brilliantly creative aschmitz Brand ambassador Tim Anderson aschmitz was nominated several times for being brilliantly creative, but one example stands out in particular. When we moved to a new system in North America, aschmitz was quick to notice that colleagues required greater functionality than was initially built in. Realising that the data required for the functionality was available to them, aschmitz worked around the clock to develop a tool that would help colleagues use the new system and continue their work uninterrupted. This brilliantly creative idea is a great example of how they jump on opportunities to find solutions and help others. Our brand ambassador award acknowledges those who love sharing the brilliant things people get up to across the business. Our global winner, Tim Anderson, kept his network in the loop on recent research, new partnerships, expert insights, and the latest NCC Group news with an unparalleled number of shares. His commitment to letting people know what’s going on at the Group makes him a true #NCCDiamond. In addition to colleague nominations, CEO Adam Palser selected Sourya Biswas as the recipient of the CEO choice award. Nominated by a significant number of colleagues for a variety of different reasons, Sourya’s impact is felt across NCC Group. Known for delighting customers through brilliantly creative solutions to problems, his expert insight is invaluable. He provides support and guidance for colleagues through guides on technical processes, by setting an admirable example, and by encouraging colleagues to be the best they can be through thoughtful feedback. His speaking engagements and publications demonstrate his great knowledge and provide new opportunities to engage with customers and prospects. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 67 Strategic reportStrategic reportSustainability continued Our focus is on building long-term sustainable relationships, earning trust through meeting our customers’ needs and delivering the highest quality of services. We, and our customers, expect our supply chain partners (and their supply chain) to behave ethically and securely and to treat everyone fairly and with respect. Supply chain partners are an extension of the NCC Group team, and our Supply Chain Code of Conduct exists to clearly articulate the standards and behaviours we expect to see in our supply chain partnerships. Our Code of Ethics sets the standard we uphold ourselves to and we take pride in our approach. We consider the interests of all our stakeholders, including colleagues, when we make decisions on the Group’s future priorities and plans. Anti-corruption and anti-bribery We do not tolerate bribery and corruption. We have established policies on anti-bribery and the receiving and giving of gifts, and hospitality. Anti-bribery awareness is part of our colleague induction process and regular refresher training is mandated. Colleagues are encouraged to report any concerns to their manager or, if required, our confidential and independent whistleblowing service. The whistleblowing process is overseen by the Audit Committee. We aim to engender in our colleagues principles of honesty and integrity and the desire to work to the best of their ability. We strive to act in a professional, honest and ethical manner in all our dealings with our customers, colleagues, shareholders, suppliers, and the community. Our reputation is paramount and nothing we do should detract from or compromise our standing in the market and the community. Our independence and impartiality as a Group are fundamental. We have a Code of Ethics, which all colleagues are required to adhered to. Supply chain Our customers and colleagues respect us for providing a trusted service, and to achieve this we rely on supply chain partners to support our business operations. We are fully aware of the responsibility we have toward our stakeholders and we seek to work with supply chain partners who are equally aware of and proud to uphold these high standards. Our relationship with supply chain partners is based on trust, collaboration and continuous improvement, underpinned by fair contracts. Human rights (including anti-slavery and human trafficking) We recognise our responsibility to uphold and protect the rights of individuals in all aspects of our operations across the world. Through our published statement and our global policies, we make it clear that we will observe and uphold the principles contained in the Universal Declaration of Human Rights and the International Labour Organization Fundamental Conventions. We believe that human rights belong equally to all people without distinction as to race, colour, sex, language, religion, political or other convictions, national or social origin, birth or other traits. We support freedom of association, the abolition of forced labour and the elimination of child labour. We have a zero-tolerance approach to modern slavery and are committed to acting ethically and with integrity in all our business dealings and relationships. We communicate this to all our suppliers, contractors, and business partners at the outset of the relationship and regularly thereafter. Our Anti-Slavery and Human Trafficking Statement is available to download from our website. Governance and oversight The Board recognises that robust governance and oversight are vital to maintaining a strong business, which can weather a changing business environment. We have a dedicated and independent Global Governance function, which has been designed to work together to ensure seamless oversight of the control environment and management decision making. This team is made up of: • Group Legal Services • Information Security • Data Protection • Compliance and Standards • Health and Safety • Internal Audit The Global Governance function reports into the Group Board, or its sub-committees, the Audit Committee and Cyber Security Committee. The primary remit of the team is to validate compliance with the Group’s policies and procedures, legislation and regulations and good practice. Read more about our governance on pages 70 to 73 and risk management on pages 40 to 48 This Strategic Report was approved by the Board of Directors and signed on its behalf by: Adam Palser Chief Executive Officer 14 September 2021 Tim Kowalski Chief Financial Officer 14 September 2021 68 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Governance As Directors we recognise the renewed focus on the contribution that a successful company can make to wider society in general, in addition to generating value for shareholders, and as a Board we want to ensure that we have effective engagement with, and encourage participation from, shareholders and other stakeholders Board composition and division of responsibilities IN THIS SECTION 70 Chair’s introduction to governance 73 Governance framework 74 Board of Directors 76 Executive Committee 78 87 Shareholder engagement 88 Audit Committee report 95 Nomination Committee report Cyber Security Committee report 98 100 Remuneration Committee report 119 Directors’ report 123 Directors’ responsibilities statement NCC Group plc — Annual report and accounts for the year ended 31 May 2021 69 Chair’s introduction to governance Committed to good governance During the year we have made the commitment that by 2024, we will have at least 33% female representation on our Board and at least one person of colour. Although this is best practice for FTSE 350 companies, we will commit to this target regardless of which share index we are in. Chris Stone Non-Executive Chair Dear Shareholder The last year has been one of unprecedented upheaval and disorder from the Covid-19 pandemic reaching all parts of the globe and significantly impacting economies everywhere. We as a Board had a very busy year dealing with the impact of the pandemic on the Group and also considering its impact on all of our stakeholders. It is worth noting that we have taken no government subsidies or loans (other than deferring tax payments), nor have we made any colleagues redundant or furloughed them during the pandemic. We continued to pay dividends, in line with our policy, throughout the year. We have also been engaged with the Executive Team in ensuring that all of our colleagues received the best support we could give them, specific to each of their individual needs, to manage in these new and changed circumstances. I have been very impressed by the depth and quality of the colleague support programme that the team has delivered. The Board is committed to creating and maintaining a culture where strong levels of governance thrive throughout the organisation, specifically ensuring that we send out consistent messages on our values and acceptable behaviours for our colleagues, our customers, our suppliers and our advisers. 2020/21 highlights • Continued to hear from our designated NED for workforce engagement who reports to every Board meeting • Supported management in the major acquisition of Iron Mountain’s Intellectual Property Management (IPM) business which will now form part of our Global Software Resilience division • Obtained a better understanding of our stakeholders and how we engage with them • An increased focus on ESG matters • Kept normal Board meetings and strategy day scheduled during lockdown with no meetings cancelled 2021/22 priorities • Continuing to focus on our stakeholders, particularly colleague engagement • Restarting off-site and overseas Board meetings to support better engagement with all colleagues • A focus on diversity around the Board table with our commitment to gender and ethnic diversity by 2024 • Continuing to focus on succession planning and diversity and inclusion amongst our wider colleague population 70 Governance standards As a Board we have focused our attention on the requirements of the UK Corporate Governance Code 2018 (the ‘Code’) and are reporting against this Code in our Annual Report and Accounts. A key focus for the 2018 Code is culture and ensuring that it aligns with the Group’s purpose, strategy and values. Culture has been high on the Board’s agenda for some time and the Board considers culture to be an essential ingredient in meeting our long-term, sustainable returns to shareholders and indeed our stakeholders. The Board, the Executive Committee and the senior management continue to promote our culture and standards throughout the business and lead by example to provide a strong corporate governance framework. One of the most significant changes to the Code affecting NCC Group is in respect of workforce engagement. Our main stakeholder is our colleagues and we wanted to develop meaningful mechanisms to ensure that we, as a Board, have meaningful and regular dialogue with our dedicated and committed workforce. This then puts us in a strong position to deliver our strategy. To assist us with this, during the year, Jennifer Duvalier, a Non-Executive Director, has continued her excellent work as our designated Non-Executive Director for workforce engagement. Jennifer (along with other Non-Executive colleagues, including me) has been meeting (albeit virtually) and speaking with colleagues around the world and reporting back on findings at each Board meeting via a dedicated agenda slot. We have not let Covid-19 be a barrier to hearing our colleagues’ opinions around the Board table. As a people business, this is a crucial area for us to focus on and get right. Towards the end of our financial year, we re-joined the FTSE 350 so we are now reflecting on the new governance provisions that are now relevant and we will report back on these next year. Board tenure as at 31 May 2021 Chris Stone Adam Palser Tim Kowalski Chris Batterham 6 years 1 month Jonathan Brooks Jennifer Duvalier Mike Ettling 4 years 2 months 3 years 6 months 2 years 10 months 4 years 3 months 3 years 1 month 3 years 8 months 31 May: 2015 2016 2017 2018 2019 2020 2021 Our approach As individual Directors we recognise our statutory duty to act in the way we each consider, in good faith, would be most likely to promote the success of NCC Group for the benefit of its members as a whole, as set out in section 172 of the Companies Act 2006. Our role as the Board is to set the strategy of the Group and ensure that management operates the business in accordance with this strategy. We believe this approach will promote the Group’s long-term success and our customers’ interests as well as create value for shareholders and have regard to our other key stakeholders such as our colleagues. The Board’s intention is to hand over the business to our successors in a better and more sustainable position for the future. We recognise the renewed focus on the contribution that a successful company can make to wider society in general in addition to generating value for shareholders, and as a Board we want to ensure that we have effective engagement with, and encourage participation from, shareholders and other stakeholders. During the year we have reflected on who our key stakeholders are and assessed our current engagement mechanisms to ensure the effectiveness of that engagement. We then factor into our decision making any feedback from that engagement. Board changes We have made no changes to the Board during the year. The biographies of all the Board members can be found on pages 74 and 75. Board composition and diversity With regard to our current diversity, I am satisfied that we have an appropriately diverse Board in terms of experience, skills and personal attributes among our Board members. The Directors have many years of experience gained across a variety of industries and sectors, ensuring a mix of views and providing a broad perspective. All that said, we recognise that we still have much progress to make in terms of improving the diversity of the Board and our Executive Team (and indeed our workforce as a whole). With that in mind, during the year we have made the commitment that by 2024, we will have at least 33% female representation on our Board and at least one person of colour. Although this is best practice for FTSE 350 companies, we will commit to this target regardless of which share index we are in. (To achieve this commitment by 2024 based on our current Board size of seven Directors, we would need to have at least three female Directors out of the seven. At least one of the seven would be a person of colour). We will look to address this during future Board and Executive Committee appointments. Given that this is a fairly young Board in terms of tenure, this improvement in diversity will not be a quick process but we are very mindful of the need to take positive action, and the matter is fully on our agenda. Accessing the candidates we require to reach this target will involve us looking beyond the obvious pool of existing board directors within the UK and we intend to ensure that we extend our talent search to other sectors and countries to ensure we find a diverse pool of candidates from which to choose to provide us with true diversity around our Board table. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 71 GovernanceGovernanceChair’s introduction to governance continued Effectiveness As Chair, I am responsible for providing leadership to ensure that the Board operates effectively. I have been supported in this by all the Directors, in particular Chris Batterham, our Senior Independent Director. The annual reviews of Board effectiveness help the Board to consider how it operates and how its operations can be improved. This year, the review was undertaken internally and the findings of this review have provided us with ideas to further improve the manner in which the Board operates, and build on previous evaluations. The results were very useful and insightful and have been incorporated into our plans for the coming year. In particular, Board succession planning remains a priority, particularly as we look to ensure the Board and Executive Committee have the right set of skills and experience to support the Group as the business evolves. I have been very impressed about how effectively the business as a whole, and indeed the Board, has transitioned to remote working during the Covid-19 pandemic. Although I feel that longer meetings are best done face to face, we have continued to hold all of our scheduled Board and Committee meetings as planned and also our strategy day in March, which all attendees agreed was our best strategy session to date. While being mindful of the impact of Covid-19 on the wider world and us as a business, our approach as a Board has been one of “business as usual” and we continue to focus on important longer-term strategic and governance issues facing the Group, while supporting management on more short-term tactical decisions. Despite most colleagues working from home, we managed to successfully purchase Iron Mountain’s Intellectual Property Management (IPM) business which will now form part of our Global Software Resilience division. The acquisition meant that we held a number of additional Board meetings throughout the year, and I was very grateful for the flexibility demonstrated by my colleagues to make sure that they were available for this process. As lockdown eases, the Board is very much looking forward to holding some in-person meetings and reconnecting with our colleagues as part of office and site visits. Our investors We are in regular contact with our large investors through a regular scheduled programme of meetings attended by either our CEO or CFO or both of them. Chris Batterham, our Senior Independent Director, and I are also available to meet with investors should the need arise. I met with our larger investors in February/March 2021 and fed back my findings to Board colleagues at the next Board meeting. In addition, our brokers undertook an investor survey on the back of our half year results in January and the results of this were presented and discussed at a Board meeting. Our aim is to engage with our shareholders in an open and meaningful way. Ensuring that the Directors’ remuneration packages align the Directors’ and senior managers’ interests with the long-term interests of NCC Group and its shareholders is always a key area of interest for investors. Our Directors’ Remuneration Policy was last approved by shareholders at the 2020 AGM and at the 2021 AGM we will be asking shareholders to approve a new Remuneration Policy. The 2020 Directors’ Remuneration Policy received 81.44% of votes in favour at the 2020 AGM. Our 2018 and 2019 Directors’ Remuneration Reports received over 99% of votes in favour, recognising the continued support of our shareholders for our approach to executive remuneration, so naturally we were very disappointed with the voting outcome of the 2020 AGM of only 51.53% votes in favour. Jonathan Brooks, as our Remuneration Committee Chair, consulted with our shareholders who voted against the Remuneration Report following this significant vote against and we published our response on 2 February 2021 which can be read here, https://www.nccgroupplc.com/media/zfhhxutu/ voting-results-of-2020-annual-general-meeting.pdf. The UK Corporate Governance Code 2018 has increased the role and remit of the Remuneration Committee and this is reported on within the Remuneration Report. As part of our new Remuneration Policy, we will be aligning our Executive Directors’ pensions with our wider colleague population, and introducing post-employment shareholding rules. Statement of compliance with the UK Corporate Governance Code The Company measures itself against the requirements of the UK Corporate Governance Code 2018 (the ‘Code’), which is available on the Financial Reporting Council website (www.frc.org.uk). From 1 June 2020 to 31 May 2021, the Company complied with the Code in full with the exceptions that our CEO and CFO pensions were not in alignment with our general colleague population, and we do not have post-employment shareholding guidelines. Both of these areas of non-compliance will be attended to post our 2021 AGM and subject to shareholder approval of our new Directors’ Remuneration Policy. Also between 1 June 2020 and 31 May 2021, the Company did not engage with the workforce to explain how executive remuneration aligns with the wider Company pay policy as required by the Code. However, the Remuneration Committee compares information on general pay levels and policies across the Group when setting Executive Director pay. Jennifer Duvalier undertakes regular colleague engagement sessions where colleagues are able to ask about Executive Director pay. During the year no questions or concerns on executive pay were raised to Jennifer. Thank you We are immensely proud of our colleagues for their extraordinary efforts during the pandemic, recognising that many were working from home in far from ideal circumstances, acting in the best interests of our customers and our stakeholders. I would like to thank all our colleagues for their incredible contribution in stepping up and meeting the unprecedented challenges of the Covid-19 pandemic. Chris Stone Non-Executive Chair 14 September 2021 72 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Governance framework The different parts of the Company’s governance framework are shown below, with a description of how they operate and the linkages between them. Board Provides leadership and is responsible for the overall management of NCC Group, its strategy, long-term objectives and risk management. It ensures the right Company structure is in place to deliver long-term value to shareholders and other stakeholders. Board Committees Support the Board in its work with specific areas of review and oversight objectives and risk management. They ensure the right Company structure is in place to deliver long-term value to shareholders and other stakeholders. Audit Committee Nomination Committee Cyber Security Committee Remuneration Committee Primary function is to assist the Board in fulfilling its financial and risk responsibilities. It also reviews financial reporting, the internal controls in place and the external audit process. Responsible for considering the Board’s structure, size, composition, diversity and succession planning. Responsible for overseeing and advising on the Group’s exposure to cyber risk and its future cyber risk strategy, its cyber security breach response and its crisis management plan and the review of reports on any cyber security incidents. Responsible for determining the overall remuneration of the Executive Directors and the remuneration of senior managers (ExCom) within the broader institutional context of remuneration practice. Read more on pages 88 to 94 Read more on pages 95 to 97 Read more on pages 98 and 99 Read more on pages 100 to 118 Chief Executive Officer Has responsibility for managing the business and overseeing the implementation of the strategy agreed by the Board. Executive Committee (ExCom) Currently comprises the Group’s most senior business and operational executives. It is responsible for assisting the Chief Executive Officer in the performance of its duties including: • Developing the budget • Reviewing the Company’s policies and procedures • Monitoring the performance of the different divisions of the Company against the plan • Carrying out a formal risk review process • Prioritisation and allocation of resources • Overseeing the day-to-day running of the Company • Being responsible for people, talent and culture For further details on Board composition and division of responsibilities see pages 78 to 86 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 73 GovernanceGovernanceBoard of Directors Our business is led by our Board of Directors. Biographical and other details of the Directors as at 31 May 2021 are as follows: Chris Stone Non-Executive Chair Adam Palser Chief Executive Officer Tim Kowalski Chief Financial Officer and Company Secretary N C Chris Batterham Senior Independent Non-Executive Director A C N R Appointment to the Board: 6 April 2017 Appointment to the Board: 1 December 2017 Appointment to the Board: 23 July 2018 Appointment to the Board: 1 May 2015 Career experience Prior to NCC Group, Adam was the CEO of NSL Ltd, the public services provider. He joined NSL in 2015 and led the successful transformation and sale of the business for its private equity owner. Between 2003 and 2013 Adam performed a number of different roles at QinetiQ including taking responsibility of QinetiQ’s cyber, information warfare and professional services businesses. External appointments Adam does not currently have any external appointments. Internal appointments Adam is an Executive sponsor of the Gender resource group. Career experience Chris has held various Non-Executive Director and Chief Executive roles at listed and private equity backed technology companies. He was CEO of Northgate Information Solutions plc from 1999 to 2008, until its sale, and stayed as CEO until 2011. From 2013 to 2016, he was CEO of Radius Worldwide. Chris was also a Non-Executive Director of CSR plc, and Chair of the Remuneration Committee, from 2012 until its sale in 2015. Chris was also Chair of AIM listed CityFibre plc from January 2017 until June 2018, when it was sold to private equity buyers. External appointments Chris is the Chair of Everynet BV, a privately owned Internet of Things infrastructure business, and Chair of AIM listed Idox plc. Chris is also a Non-Executive Director of Rural Broadband Solutions Plc. Career experience Tim is an accomplished CFO with significant listed and private company experience. Prior to joining NCC Group, Tim was Group Finance Director of Findel Plc between 2010 and 2017 and prior to that held similar roles with Homestyle Group Plc and N Brown Group Plc. Tim has significant experience of divisional financial management within the hospitality sector. Tim qualified as a Chartered Accountant with KPMG and spent his early career there. Tim has a wide breadth of finance expertise obtained from experiencing differing finance roles within organisations and also within a variety of companies, and has been involved in a number of high profile financial turnarounds. External appointments Tim does not currently have any external appointments. Internal appointments Tim is an Executive sponsor of the Race and Ethnicity resource group. Career experience Chris is a qualified Chartered Accountant, spending his early career with Arthur Andersen, and also has significant experience in senior finance roles across the technology sector. Chris was Finance Director of Unipalm plc (the first internet company to IPO in the UK) from 1996 until 2001, before becoming CFO of Searchspace Limited until 2005 and has since held a wide variety of non-executive and advisory roles, the majority having a technology focus. External appointments Chris is currently the Senior Independent Director and Non-Executive Deputy Chair of Blue Prism Group plc (and also chairs the nomination committee, as well as being a member of its audit and remuneration committees) and Non-Executive Director at Nanoco Group plc (and also chairs the audit committee, as well as being a member of its nomination and remuneration committees). Chris is also Chair of Racing Digital Limited. Committee key: A Member of Audit Committee C Member of Cyber Security Committee N Member of Nomination Committee R Member of Remuneration Committee Committee Chair 74 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Diversity of skills and experience Strategy development Jonathan Brooks Independent Non-Executive Director Jennifer Duvalier Independent Non-Executive Director Mike Ettling Independent Non-Executive Director Sales and marketing R A C N C N R A Human resources Corporate governance Financial management M&A Professional services Appointment to the Board: 16 March 2017 Appointment to the Board: 25 April 2018 Appointment to the Board: 22 September 2017 Career experience Jonathan was Chief Financial Officer of ARM Holdings plc from 1995 until 2002. He has since held a number of Non-Executive Director positions with listed and private technology businesses, including chairing the audit committees at IP Group, Aveva Group, FDM Group, Sophos Group PLC, and e2v PLC. He also chaired the remuneration committees of IP Group and Xyratex Ltd, where he also served as Chair between 2011 and 2013. External appointments Jonathan does not currently have any external appointments. Career experience Jennifer was Executive Vice President of People at ARM Holdings plc, with responsibility for all people and internal communications activity globally, from September 2013 to March 2017. External appointments Jennifer is currently the Senior Independent Director of Trainline plc (where she is also a member of the audit and risk, nomination and remuneration committees) and an independent Non-Executive Director and Chair of the Remuneration Committee of Mitie Group plc (as well as being a member of its nomination committee) (she is also the designated Non-Executive Director for colleague engagement at both companies) and of Guardian Media Group plc. She is Non-Executive Director of The Cranemere Group Ltd, a member of The Council of the Royal College of Art and Chair of the Remuneration Committee, and a senior adviser to the Cleveland Clinic London and M Squared. Career experience Mike has strong sector and non-executive experience. He has had an extensive career in global technology businesses including SAP-Sucessfactors, NorthgateArinso, Unisys, Synstar and EDS and was formerly a Non-Executive Director of Backoffice Associates LLC, a US PE backed data business, and also formerly a Non-Executive Director of Telkom BCX Ltd, a South African IT and telecommunications business. Mike has also served as a Non-Executive Director with Topia Inc, a Silicon Valley cloud relocation software business. External appointments Mike is currently CEO of Unit4, a world leader in enterprise applications for services and people organisations. He is also Non-Executive Director of Impellam PLC, an AIM listed recruitment business. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 75 GovernanceGovernanceExecutive Committee Max Baldwin Group Sales and Marketing Director Steve Boughton Global Operations Director Max joined the Group in October 2019 and is responsible for inspiring and challenging its business growth plans towards continued sustainable and profitable revenue. Max owns the Group Marketing function and provides regional sales and portfolio teams with global insight, tools, techniques and direction that support their business winning objectives. Max was the Executive sponsor of the Race and Ethnicity resource group in FY21. Steve is responsible for our Group transformation programme and for Group central services around the world. He joined the business in March 2018 from the NSL Group where he was the Chief Operating Officer supporting the business through its sale in 2017, and previously served as Managing Director of QinetiQ’s technical advisory business, leading software and service subsidiaries in the UK, Canada and Australia. In FY22 Steve will be the Executive sponsor of the new Accessibility resource group. Simon Fieldhouse Global Managing Director, Software Resilience Yvonne Harley Global Director of Sustainability and Corporate Affairs Simon is Global Managing Director of the Software Resilience division, with locations in the UK, the USA, Europe and the Middle East. Simon is focused on returning the division to sustainable growth, supporting Group investment in product innovation to underpin growth across our EaaS cloud portfolio. Having completed the acquisition of the Intellectual Property Management company from Iron Mountain, Simon is leading the integration of the IPM business into NCC Group. Prior to NCC Group, Simon was the CEO of Hardware.com, an international value-added reseller of hybrid IT solutions operating in the UK, the USA, Europe and South Africa. In FY22 Simon will be Executive sponsor alongside Tim Kowalski of the Race and Ethnicity resource group. Yvonne is Global Director of Sustainability and Corporate Affairs responsible for driving our sustainability strategy and setting communication standards, channels, brand reputation, colleague communication, public relations and crisis communication as well as co-sponsoring our inclusion and diversity engagement initiatives with Chief People Officer, Colin Watt. Joining the Group in July 2018, Yvonne has international experience across a range of industry sectors, which includes senior roles in financial services, oil and gas, and shipping. Robert Horton Global Head of Assurance Delivery Nick Rowe Managing Director, Assurance North America Robert has worked in a number of areas across the Group, most recently on the creation of the single European division. He is also the Executive sponsor for Global Managed Services. Currently he is involved in the business transformation programme driving business alignment. Robert was a Director of NGS Software, a security consulting company he co-founded, from its formation in 2001 through to its acquisition by and successful integration into the Group in 2008. Nick is Managing Director of the North American Assurance division based in California. He has held positions across business development, consulting and operations management since joining the firm in 1998. Currently Nick is responsible for the Group’s North American operations since relocating from the UK in 2013 and while the primary focus is on the growth of this region Nick also sponsors global initiatives across sales, marketing and, as part of the Group-wide commitment to diversity and inclusion, the Neurodiversity resource group in FY21. 76 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Inge Bryan Managing Director, Assurance Europe Ian Thomas Managing Director, Assurance UK and RoW Inge is Managing Director for NCC Group’s Continental European operations, including Fox-IT and the former Fort Consult brand (Denmark). With a strong career in cyber and security she has previously held roles with the Dutch National Police and the General Intelligence and Security Service of the Netherlands and served as Home Affairs Counsellor in the Royal Netherlands Embassy in Paris. Before she joined NCC Group Inge was part of the cyber security leadership team with Deloitte Risk Advisory, securing the critical infrastructure of the Netherlands, including central government. In 2019 she was listed in the top 100 most influential women in the Netherlands and one of the 50 most inspiring women in tech. In FY22 Inge will sponsor the Neurodiversity resource group. Ian joined NCC Group in December 2018 and is responsible for the Group’s UK and RoW Assurance division and acts as Executive sponsor for Global Professional Services and for the LGBTQIA+ community. Prior to that he was UK MD at Sopra Steria for two and a half years, following a successful interim career working for a number of global businesses and private equity backed firms, in Managing Director and Sales Director positions. He was at Cable&Wireless for eight years, where he ran global service assurance and the wholesale and public sector divisions. Ian’s early career includes 14 years at British Airways. Colin Watt Global Chief People Officer Ollie Whitehouse Chief Technical Officer Colin is the Global Chief People Officer for NCC Group. He is responsible for the human resources team across the Group, as well as being the co-sponsor with Yvonne Harley on the Group’s inclusion and diversity initiatives. Prior to joining NCC Group, Colin was the Director of Employee Engagement and Relations at Shop Direct, the online digital retailer. He previously held a number of senior leadership roles in Telefonica’s O2UK, research, European and global HR teams and Co-operative Financial Services. Ollie is Chief Technical Officer at NCC Group responsible for the Group’s technical strategy, research, product and development functions. Ollie is ultimately tasked with ensuring that NCC Group is well placed with capability and technology to exploit market opportunities now and in the future. In FY21 Ollie was the Executive sponsor of the Gender resource group. Joining the Group in 2012, over the past 25 years Ollie has worked in a variety of cyber security consultancy, applied research and management roles. Ollie is Chair of a science advisory council to the UK government and is an adviser on matters of cyber security to several government departments. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 77 GovernanceGovernanceBoard composition and division of responsibilities Role profiles are in place for the Chair and Chief Executive Officer, which clearly set out the duties of each role. Role Responsibilities Chair of the Board (Chris Stone) Chief Executive Officer (Adam Palser) Chief Financial Officer (Tim Kowalski) Senior Independent Director (Chris Batterham) Is responsible for the running and leadership of the Board, setting its agenda and ensuring its effectiveness on all aspects of its role, and promoting a culture of openness, debate and the highest standards of corporate governance. The Chair, in conjunction with the CEO and other Board members, plans the agendas, which are issued with the supporting Board papers in advance of the Board meetings. These supporting papers provide appropriate information to enable the Board to discharge its duties which include monitoring, assessing and challenging the executive management of the Group. Together with the senior management team (ExCom), is responsible for the day-to-day running of the Group’s business, implementing the strategy and policies approved by the Board, and regularly providing performance reports to the Board. The role of CEO is separate from that of the Chair to ensure that no one individual has unfettered powers of decision. Works closely with the CEO with specific responsibility for all financial matters, including Group accounting policies, financial control, tax and treasury management, risk management and financial probity. The CFO is also accountable for the transparency and appropriateness of management information and key performance indicators, internally and externally. Provides a sounding board for the Chair and serves as an intermediary for other Directors, colleagues and shareholders when necessary. The main responsibility is to be available to the shareholders should they have concerns that they have been unable to resolve through normal channels or when such channels would be inappropriate. Non-Executive Directors (Jonathan Brooks, Jennifer Duvalier and Mike Ettling) Bring experience and independent judgement to the Board. Maintain an ongoing dialogue with the Executive Directors which includes constructive challenge of performance and the Group’s strategy. Designated Non-Executive Director for engagement with the workforce (Jennifer Duvalier) Company Secretary (Tim Kowalski) Leads on Board engagement with the workforce (please see separate section on page 80). Ensures good information flows within the Board and its Committees and between senior management and Non-Executive Directors. The Company Secretary is responsible for facilitating the induction of new Directors and assisting with their professional development as required. All Directors have access to the advice and services of the Company Secretary to enable them to discharge their duties as Directors. The Company Secretary is responsible for ensuring that Board procedures are complied with and for advising the Board through the Chair on governance matters. The appointment and removal of the Company Secretary is a matter for the Board as a whole. Tim is supported with his company secretarial duties by a Deputy Company Secretary. Meetings and attendance The Board considers that each Director is able to allocate sufficient time to the Company to discharge their responsibilities effectively. The Non-Executive Directors are contracted to spend a minimum of 24 days per annum on the Group’s affairs, and the Chair 60 days. A summary of each current Director’s attendance at meetings that they were eligible to attend of the Board and its Committees during the financial year ended 31 May 2021 is shown below. Unless otherwise indicated, all Directors held office throughout the year. More Board meetings than usual were held during the year due to the delayed full year results caused by Covid-19, plus the acquisition of IPM. Board Audit Nomination Cyber Security Remuneration Chris Stone Adam Palser Tim Kowalski Chris Batterham Jonathan Brooks 1 Jennifer Duvalier Mike Ettling 2 N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A Committee Chair 1 Was absent for July 2020’s meetings due to sudden illness. Jennifer Duvalier chaired the July 2020 Remuneration Committee meeting. 2 Was absent due to personal circumstances. 78 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 What have we looked at as a Board during 2020/21? At every meeting the Board reviews the minutes from the previous meeting and the status of any outstanding actions. Colleague engagement is a standing agenda item presented by Jennifer Duvalier as our designated Non-Executive Director for workforce engagement. The CEO and CFO present their monthly performance update reports, which are also circulated to Board members in months where there is no scheduled Board meeting. Over the year, the Board has had reports on the Group’s trading in light of Covid-19 along with the defensive measures the Group has taken in response to the pandemic. Potential opportunities created by Covid-19 have also been discussed. A significant proportion of the Board’s time has been spent on the IPM acquisition. The Board has also reviewed the following during 2020/21: Leadership and colleagues • Received an update on colleague engagement and the results of the annual colleague engagement survey • Approved a number of share scheme grants to colleagues including UK Sharesave, International Sharesave (in Australia, Denmark, the Netherlands, and Spain), and the Employee Stock Purchase Plan (in the US and Canada) • Discussed a colleague death in service and approved the placing of the insurance proceeds into trust for the beneficiary • Continued with the colleague engagement programme, with an appointed designated Non-Executive Director leading, with an update to the Board at every Board meeting • Appointed a European Managing Director for Assurance (Inge Bryan) • Had a presentation from the Global Head of Research and Development Strategy • Received regular updates on the Group’s transformation programme, “Securing Growth Together” (SGT) • Held a dedicated one day strategy session (see page 80) • Discussed the strategy day and the key points arising out of it, and had a strategy day progress check six months later • Approved a Group entity reorganisation and the establishment of subsidiary companies in Belgium, Germany and Sweden • Discussed a number of sector IPOs plus investments that competitors had made during the year Governance • Completed the Board, Committee and Chair effectiveness reviews and discussed the results of these reviews, agreeing on key focus areas for the coming year • Approved the Notice of AGM and Proxy Form • Had a number of presentations on the Group’s ESG work and progress (labelled as “sustainability” internally) • Attended the AGM and the general meeting to seek shareholder approval for the IPM acquisition • Recommended new share plan rules to shareholders for approval at the AGM • Received a governance and audit update from KPMG • Had presentations on the Group’s key stakeholders, e.g. our customers, suppliers and network, and reflected on Board stakeholder engagement and improving the mechanisms for this • Noted and approved the updated Code of Ethics Policy • Had a presentation from a representative from the National Cyber Security Centre • Received updates on a number of high profile cyber attacks that had been targeted at other companies and organisations • Approved some minor amendments of an administrative nature to share plan rules • Discussed and approved the Group’s Modern Slavery Statement • Reviewed Directors’ outside directorships and potential conflicts of interest and also Directors’ shareholdings, along with the annual review of Non-Executive Director independence Financial • Reviewed and approved the Annual Report and Accounts, ensuring that it is fair, balanced and understandable • Discussed and approved the full year and half year results and associated presentations to investors • Approved the interim and final dividends and discussed the dividend policy • Noted and approved the 2020/21 Group insurance cover renewal and had a presentation from the Group’s insurance brokers • Discussed and approved the 2021/22 budget • Received presentations from the brokers and financial PR advisers • Considered and approved trading updates at the full and half year end • Received regular updates from investor meetings and noted circular investor letters • Received presentations on shareholder perspectives on the Company • Continued with the colleague engagement programme, with an appointed designated NED leading the Board’s engagement activities Other Group business • Numerous Board meetings, discussions and presentations from colleagues and external advisers on the IPM acquisition • Kept updated on a number of strategic projects including the implementation of new business systems such as Salesforce and Workday and SGT • Had a presentation on the Group’s Transport practice • Approved a number of major customer contracts and bids • Received regular updates on material litigation affecting the Group NCC Group plc — Annual report and accounts for the year ended 31 May 2021 79 GovernanceGovernanceBoard composition and division of responsibilities continued Board strategy session In March 2021 the Board held a dedicated one day strategy session which allowed for “deep dives” into all aspects of the Group’s business. As the Group remains focused on the successful execution of its strategy, the March 2021 Board strategy day presented an opportunity to understand the trends and changes in the cyber and software resilience markets, assess the Board’s confidence in the Group’s strategic direction, and discuss our preparedness to make any future changes. To prepare, Board members received a briefing pack in advance of the day which contained a concise, high level presentation for each business unit, including an overview of global and regional inclusion and diversity initiatives and colleague engagement programmes, along with additional background briefing material, to allow for high quality presentations and discussions on the day. The Board strategy day itself focused on our Global Software Resilience and Global Assurance divisions. Advisers and brokers offered an external view of the broader market environment for both, before the divisions’ Managing Directors presented to the Board on their transformation plans for growth, provided their reflections on NCC Group’s opportunities within Europe and beyond, and outlined progress and expectations for the Group’s growth propositions, notably the Microsoft Sentinel and Remediate offers. Following an open exchange of views between Managing Directors and the Board to discuss any outstanding questions, the Board strategy day concluded with a Board only discussion that focused on driving long-term value creation for NCC Group. The Board agreed that the 2021 strategy day had been the best to date, provided thought provoking and inspirational insights, and demonstrated the Group’s decisive strategic action to realise its vision. Managing Directors used the feedback from the day to inform their 2021/22 budget considerations and associated approvals, and a progress check will be held at the halfway point to the 2022 strategy day to ensure that the agreed actions remain on track and the Group remains in the best possible position to increase its chances of success. Colleague engagement I have really enjoyed getting out and meeting with colleagues across the Group albeit virtually. I have been very pleased by the positive comments received and have been impressed by the people I have met and their engagement and dedication particularly working remotely, with a number of recent joiners never having met their colleagues in person! Of course, there are things to be addressed, of which some are “quick wins”, but some matters will take longer to address. Colleagues also make really helpful suggestions as to how we can improve how the business runs which I feed back to management. I hope that as the designated Non-Executive Director I am able to facilitate positive change and ensure that the colleague voice is heard strongly within the boardroom and reflected within all the decisions we as a Board make that impact our most important stakeholder. Jennifer Duvalier Designated Non-Executive Director Jennifer Duvalier is the Board’s designated Non-Executive Director to lead the Board’s colleague engagement programme. Jennifer also undertakes the designated Non-Executive Director role at both Trainline plc and Mitie Group plc meaning she has the relevant experience as to what is needed and can draw on her successful HR career. She is committed to understanding the views of our colleagues and ensuring they are incorporated into the Board’s decision-making process. Colleagues were introduced to Jennifer via our internal social channels where she explained her role through a video and written communications. Jennifer has access to these channels to enable her to engage fully outside of the formal events. Jennifer has not let Covid-19 get in the way of her engagement activities and the past year has been a busy one with Jennifer meeting colleagues virtually from Australia, the Netherlands, San Francisco, Seattle, Canada, Singapore, Japan and Spain. We were keen to build on the momentum in the previous year. Jennifer is sometimes joined by our Chair, Chris Stone, or other Non-Executives, to meet colleagues, all of whom are invited from below the mid-management level and all parts of the business to ensure diversity of thought. We ensure that no one has their line manager in the (virtual) room to ensure they can speak freely and tell Jennifer what is on their mind. Feedback from each session’s participants is shared anonymously to the Board and to our CEO, Adam Palser. This enables action to be taken, further strengthening the value of listening. Colleagues attending are invited to give their feedback and, so far, results have been positive and valued. 80 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Independent advice All Directors have access to the advice and services of the Company Secretary and Directors are entitled to take independent professional advice if necessary, at the expense of the Company. Conflicts of interest The Companies Act 2006 requires Directors to avoid situations where they have, or could have, a direct or indirect interest that conflicts or potentially conflicts with the interests of the Company. The Company’s Articles of Association require any Director with a conflict or potential conflict to declare this to the Board. That Director will not then be involved in the discussions relating to the proposal, transaction, contract or arrangement in which they have an interest, unless agreed otherwise by the Directors of the Company in the limited circumstance specified in the Articles of Association, nor will they be counted in the quorum or be permitted to vote on any issue in which they have an interest. Directors are required to inform the Board without delay should they be aware of any actual or potential conflicts of interest and a check on conflicts is undertaken each year with a report to the Board. Board independence As required by the Code, at least 50% of the Board, excluding the Chair, are independent Non-Executive Directors. The Board comprises two Executive Directors, four independent Non-Executive Directors, and the Non-Executive Chair. The Board has debated and considers that all of the current Non-Executive Directors are independent, and in so doing considered the profile of all of the individuals, concluding that none of them: • Has ever been a colleague of the Group • Has ever had a material business relationship with the Group or receives any remuneration other than their salary or fees • Has close family ties with the advisers, other Directors or senior management of the Group that could reasonably be expected to cause a conflict • Holds cross-directorships or has significant links with other Directors through involvement with other companies or bodies • Represents a significant shareholder • Has at the point of this report served on the Board for more than nine years from the date of their first election The Non-Executive Directors provide a strong independent element on the Board and are well placed to constructively challenge and help develop proposals on strategy and succession planning. Between them they bring an extensive and broad range of experience to the Group. Details of the Directors’ respective experience are set out in their biographical profiles on pages 74 and 75. The terms and conditions of appointment of Non-Executive Directors are available for inspection at the Company’s registered office during normal business hours. Diversity The principle of Board diversity (and indeed diversity across the Group) is strongly supported by the Board. It is the Board’s policy that appointments to the Board will always be based on merit so that the Board has the right balance of individuals in place. The Board recognises that diversity of thought, approach and experience is an important consideration and is therefore one of the selection criteria used to assess candidates prior to any Board appointments. Read more about diversity in the Nomination Committee Report on pages 95 to 97. The Company’s policy is to find, develop and maintain a diverse workforce at all levels with an initial focus on developing a culture where women can achieve and retain senior positions. Annual re-election In accordance with the Code, any Directors appointed in the financial year are subject to election by shareholders at the AGM and, in line with best practice, all the other Directors are subject to re-election annually. Director induction, training and development No new members of the Board were appointed during the year. New Directors are provided with an induction on appointment, which would include visits to the Group’s operations and meetings with operational and executive management. Each Director’s induction is tailored to their experience and background with the aim of enhancing their understanding of the Group’s strategy, business, operating divisions, colleagues, customers, suppliers and advisers and the role of the Board in setting the tone of our culture and governance standards. The Company acknowledges the importance of developing the skills of the Directors to run an effective Board. To assist in this, Directors are given the opportunity to attend relevant courses and seminars to acquire additional skills and experience to enhance their contribution to the ongoing progress of the Group. All of the Directors attend sessions which are aimed at updating the Board on trends and developments in corporate governance. Board and Committee effectiveness review The performance of the Board and its Committees is appraised annually and an internal effectiveness review was completed for 31 May 2021. The overall rating was very positive meaning that the Board and its Committees continue to function well. The results were presented to the May 2021 Board meeting and the Chair also held one-to-one calls with Board colleagues for “deeper dives” into any areas they wished to discuss in more detail and with the CEO to discuss areas highlighted by the evaluation process. We have also scheduled in a progress check in September 2021 to ascertain how we are doing against our proposed improvements and whether we need to do anything different in the second half of the financial year. The evaluation identified changes which would improve the working of the Board, including: • An increased focus on diversity • Assessing and monitoring culture • A continued focus on strategy and strategic discussion • An increased focus on succession planning and ensuring that these plans are reviewed on a regular basis • An increased focus on CSR/ESG Although all of the above were considered important, it was agreed that the key area to focus on would be succession planning. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 81 GovernanceGovernanceBoard composition and division of responsibilities continued Board and Committee effectiveness review continued How will we improve in these areas? To focus on these actions, we have agreed the following: Action Progress and our plan An increased focus on diversity • Firm commitment to at least 33% female representation and at least one person of colour on the Board by 2024 Assessing and monitoring culture • Presenters to the Board encouraged to highlight diversity statistics within their business area as happened during the strategy day, when each presenter did this • Appointment of Inge Bryan as Managing Director of NCC Assurance Europe • Unconscious bias training has now been completed by the Board with the ExCom having already completed it • Significant work underway internally on creating an inclusive culture throughout the organisation • More Board discussion on ensuring our culture aligns with our values • Regular updates on how colleagues were coping with remote working during Covid-19 and the support available to them • Presenters to the Board encouraged to highlight culture initiatives within their business area • Board to have more exposure to senior executives across the business • Having a designated NED for workforce engagement reporting back to every Board meeting has helped with this (please see page 80 on colleague engagement for further details) • NEDs to spend more time in the business and at different offices (which will be done in person as we come out of lockdown) • Reporting on the “mood” of the business within the monthly CEO reports and areas of concern or where there are higher than expected colleague attrition levels • Discussing the results of both the annual colleague engagement survey and the more regular “pulse” surveys A continued focus on strategy and strategic discussion • One day dedicated strategy session now held annually, attended by all divisional Managing Directors and this year by brokers and advisers to provide an external and wider market perspective • Ensuring strategy is more of an ongoing Board discussion between annual strategy days rather than a once a year activity • Shifting Board discussion away from short-term tactical issues to more longer-term strategic issues • Actions from dedicated strategy day circulated to the Board with a check-in on strategy halfway through the year An increased focus on succession planning and ensuring that these plans are reviewed on a regular basis • Nomination Committees now being held with a programme of four Committee meetings planned every year with the Committee moving away from a transactional Committee (e.g. to recruit a new Director) to a more holistic view encompassing: future skills needs, talent pipelines, diversity, succession planning, and reviewing leadership needs of the Company • Nomination Committee redoubling focus on succession planning for the Board and senior management including discussing Executive Director succession planning in general terms • Chris Stone (Nomination Committee Chair) and Colin Watt (Global Chief People Officer) are now meeting regularly and discussing a separate workstream on succession planning 82 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Action Progress and our plan An increased focus on CSR/ESG (labelled as “sustainability” internally) • Global Director of Sustainability and Corporate Affairs taken on ESG lead within the Group and presents every six months to the Board • Gap analysis has been undertaken to provide an action plan to close the gaps and an ESG framework has now been developed • Policies have been refreshed and standardised (e.g. Code of Ethics and Modern Slavery). The whole organisation has undertaken Code of Ethics refresher training • Increasing recognition that this area will become an ever-more important area for new and existing clients and investors when they are evaluating who to buy from and partner with/invest in • Improving the visibility of what the organisation is doing with regard to ESG and ensuring that all the ESG initiatives and activities are being properly recorded and reported • TCFD will be reported on within the 2022 Annual Report. A TCFD steering group has been formed • Partnerships with external organisations being developed, e.g. we have become a member of Business in the Community (BitC) and joined the UN Global Compact (UNCG) at the “Participant” membership level. With BitC, we have taken part in its Responsible Business Tracker Progress from the previous year The 2021 evaluation process also reviewed progress on actions identified in previous evaluation processes. Areas identified in previous evaluations An increased focus on succession planning and ensuring that these plans are reviewed on a regular basis An increased focus on CSR/ESG A continued focus on strategy and strategic discussion Enhancing Board interactions and communications with the Company and its customers Developing Board involvement in the Group’s culture related initiatives 2021 evaluation – progress Good progress and firmly on the Board’s and Nomination Committee’s agenda with a firm commitment to at least 33% female representation on the Board and at least one person of colour by 2024 (see above table for further details). Good progress and firmly on the Board’s agenda (see above table for further details). Good progress with the 2021 strategy day felt to be the best to date (see above table for further details). Good progress. The Board has continued to interact with a significant number of colleagues on both a Company-wide basis and via receiving presentations from various members of the ExCom plus senior managers. There are regular updates on customers within the CEO’s Report. Good progress (see above table for further details). NCC Group plc — Annual report and accounts for the year ended 31 May 2021 83 GovernanceGovernanceBoard composition and division of responsibilities continued Board, Committee and Chair evaluation process 2021 Company Secretary reviewed 2020 questionnaires and evaluation exercise results and, based on this, proposed questionnaires for the 2021 evaluation exercise. The proposed questionnaires were reviewed and approved by the Chair and Committee Chairs and (for the Chair’s review) the Senior Independent Director. Questionnaires were added to an online survey website which ensured the anonymous and efficient collection of answers. Summary reports together with the results and comments received were prepared for the Board and Committee meetings where the results were discussed and key actions for the coming year agreed. The responses were collated and analysed by the Company Secretary who then shared these with the Chair and Committee Chairs and (for the Chair’s review) the Senior Independent Director. Board members, the Company Secretary and regular Committee attendees were then invited to complete the questionnaires. The Chair held one-to-one meetings with Board members where areas of interest could be discussed in more detail. The Senior Independent Director met with the Chair to discuss the Chair evaluation results. Committee evaluation During the year, each of the Audit, Remuneration, Nomination and Cyber Security Committees carried out an internal self-evaluation on their effectiveness. The conclusion from the Committee reviews is that, overall, the Committees are working well but some recommendations were made, as per the table below. Committee Audit Focus areas • Continuing to focus on reducing the length of Committee papers (using summaries where appropriate) but acknowledgement that the internal papers had improved • Continuing to ensure that Committee papers were circulated as early as possible • An acknowledgement that Covid-19 (and the delay to the 2020 full year results) had resulted in too many Committee meetings and the number of meetings should be reduced to normal levels • The change in audit partner during the year was felt to have brought a refreshed perspective to the external auditor’s view and the audit partner’s onboarding should continue Cyber Security • Continuing to take the papers/presentations as read and focusing on more value-adding dialogue, discussion, and interaction rather than going through the Committee briefing packs • Acknowledgement that the presentation from the Director of Operations at the UK’s National Cyber Security Centre (NCSC) had been excellent and more external presenters should be used where possible • A review of whether external advisers/consultants could attend future Committee meetings • More frequent updates on the nature of the changing cyber threat landscape, e.g. what are the current major topics within cyber and the significant threats 84 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Committee Nomination Focus areas • Making strong initial progress with our firm commitment to have at least 33% female representation and at least one person of colour on the Board by 2024 • Succession planning for the Board and senior management and in particular a discussion on Executive Director succession planning in general terms over the next 6–12 months • Improving succession plans for senior executives and improving exposure to senior executives at Board meetings and within more informal settings Remuneration • Continuing to have opportunities for more open and unfettered discussion (Executive Directors and HR colleagues are now invited to meetings on a by exception basis) • Embedding the 2021–2024 Directors’ Remuneration Policy (subject to shareholder approval at the 2021 AGM) • Ensuring that the Group’s reward structure aligns to the key issues facing the Group rather than standard industry practice • Continuing to focus on choosing appropriate benchmarks against which to compare NCC Group’s remuneration packages against Individual Director appraisal process During the year, the Senior Independent Non-Executive Director evaluated the performance of the Chair and the Chair evaluated the performance of each Director. In addition, the Non-Executive Directors met independently from the Executive Directors to discuss with the Chair the overall functioning of the Board and his contribution in making it effective. Operation of governance framework Role of the Board The Board is responsible for reviewing, challenging and approving the strategic direction of the Group, while providing strong values-based leadership of the Company, within a framework of prudent and effective controls, which enable risk to be assessed and appropriately managed. The Board reviews the Group’s business model and strategic objectives to ensure that the necessary financial and human resources are in place to achieve these objectives, to sustain them over the long term and to review management’s performance in their delivery. The Board sets the tone of the Company’s values and ethical standards and manages the business in a manner to meet its obligations to shareholders and other stakeholders. The Board receives information on at least a monthly basis to enable it to review trading performance, forecasts and strategy and it has a schedule of matters specifically reserved for its decision. The most significant of these are: • Approval of strategic plans, the annual budget and any material changes to them • Oversight of the Group’s operations, ensuring competent and prudent management, sound planning, and an adequate system of internal control and governance • Through the Audit Committee, oversight of financial reporting systems and information and adherence to appropriate accounting policies • Changes to the structure, size and composition of the Board and Executive Committee, and oversight of the Company culture and the ethical standards of the leadership and the independence of Non-Executive Directors, taking into consideration prudent succession planning • Approval of the acquisition or disposal of subsidiaries and major investments and capital projects • Approval of the dividend, treasury and banking policies, including the Group’s capital structure • Through the Remuneration Committee, the delivery of an effective executive and senior management Remuneration Policy • Receiving reports on the views of shareholders and approval of all documents put to shareholders at a general meeting or circulated to shareholders • Approval of the appointment of key advisers The Board has a schedule of specific matters reserved for its decision where it feels they are critical to the ongoing success of the business and are of a significant nature to merit the Board having such a decision reserved to it. The Group also has a Group Authority Matrix (which documents the levels of authority delegated from the Board to various role holders within the Group). The schedule of matters reserved for decision by the Board and the Group Authority Matrix are complementary documents and are designed to ensure that decisions are either made by the Board or delegated to an appropriate senior colleague within the Group. As noted above, the operational management of the Group is delegated to the Executive Committee. The Board also delegates other matters to Board Committees and management as appropriate. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 85 GovernanceGovernanceBoard composition and division of responsibilities continued The Audit Committee makes a recommendation to the Board on effectiveness which the Board considers, together with reports from the Cyber Security Committee, in forming its own view on the effectiveness of the risk management and internal control systems. During the year ended 31 May 2021, the Board reviewed the effectiveness of the Group’s risk management and internal control systems. We confirm that the processes outlined above and on page 92 have been in place for the year under review and up to the date of approval of this Annual Report and Accounts and that these processes accord with the UK Corporate Governance Code and the FRC Guidance on Risk Management, Internal Control and Related Financial and Business Reporting. We also confirm that no significant failings or weaknesses were identified in relation to the review. Executive remuneration During the year, we operated within the Remuneration Policy approved by shareholders at the 2020 AGM. Details of how the Remuneration Policy has been applied during this financial year are set out on pages 103 to 108 of the Remuneration Committee Report. Risk management The Board has ultimate responsibility for ensuring that business risks are effectively managed. The Board has delegated regular review of the risk management procedures to the Cyber Security Committee in relation to cyber risks and to the Audit Committee in relation to all other risks. The Board reviews the overall risk environment on at least an annual basis. The day-to-day management of business risks is the responsibility of the Executive Committee. Internal control The Group has a system of internal controls which aims to support the delivery of the Group’s strategy by managing the risk of failing to achieve business objectives and to protect the stewardship of the Group’s assets. As with all such systems, the goal is to manage risk within acceptable parameters rather than to eliminate risk entirely. The Group can therefore only provide reasonable and not absolute assurance that the business objectives and asset stewardship will be provided successfully. In addition, the Group insures against various risks, but certain risks remain difficult to insure, due to the breadth and cost of cover. In some cases, external insurance is not available at all, or at least not at an economically viable price. The Group regularly reviews both the type and amount of external insurance that it buys in conjunction with its insurance brokers. For a more detailed review of risk management processes, the principal risks faced by the Group and their mitigation, see pages 40 to 48. The Audit Committee is responsible for reviewing the effectiveness of the risk management and internal control systems. The steps it takes in relation to the review are set out on page 92. 86 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Shareholder engagement Share capital structure The Company’s issued share capital at 31 May 2021 consisted of 308,956,045 ordinary shares of 1p each. There are no special control rights or restrictions on share transfer or special rights pertaining to any of the shares in issue and the Company does not have preference shares. As far as is reasonably known to the Board, the Company is not directly or indirectly owned or controlled by another company or by any government. Board engagement with shareholders Communications with shareholders are given high priority. There is a regular dialogue with institutional investors including presentations after the Company’s year end and half year results announcements. A programme of meetings takes place throughout the year with major institutional shareholders, and private shareholders have the opportunity to meet the Board face to face and ask questions at the AGM. We are in regular contact with our large investors through a regular scheduled programme of meetings attended by either our CEO or CFO or both of them. Chris Batterham, our Senior Independent Director, and I are also available to meet with investors should the need arise. I met with our larger investors in February 2021 and fed back my findings to Board colleagues at the next Board meeting. In addition, our brokers undertook an investor survey on the back of our half year results in January and the results of this were presented and discussed at a Board meeting. Our aim is to engage with our shareholders in an open and meaningful way. During the financial year the Directors held a number of meetings with shareholders as set out below. Board shareholder updates Feedback from major institutional shareholders is provided to the Board on a regular basis and, where appropriate, the Board takes steps to address their concerns and recommendations. Investor meetings One-to-one meetings (held virtually due to Covid-19) Group meetings 31 2 Substantial shareholdings As at 31 May 2021, the Company had been notified of the following interests of 3% or more in the issued share capital of the Company under the UK Disclosure and Transparency Rules: Shareholder Artemis Investment Management BlackRock, Inc Castlefield Fund Partners Montanaro Asset Management Schroder Investment Management Unicorn Asset Management Number of ordinary shares 13,822,640 14,224,646 14,325,000 16,546,426 15,364,318 10,796,426 % of NCC’s total share capital 4.98% 5.15% 5.16% 5.90% 5.53% 3.89% The following changes to the above interests have been notified to the Company from 31 May 2021 to 14 September 2021. Shareholder Number of ordinary shares % of NCC’s total share capital Canaccord Genuity Wealth Group Limited 15,580,182 5.04% Directors’ shareholdings For details of Directors’ shareholdings, remuneration and interests in the Company’s shares and options, together with information on service contracts, see pages 109 to 118 of the Directors’ Remuneration Report. Annual General Meeting The AGM is an opportunity for shareholders to vote on certain aspects of Group business and provides a useful forum for one-to-one communication with private shareholders. At the AGM shareholders receive presentations on the Company’s performance and may ask questions of the Board. The Chair seeks to ensure that the Chairs of the Audit, Remuneration, Nomination and Cyber Security Committees are available at the meeting to answer questions and all Directors attend. The Company prepares separate resolutions on each substantially separate issue to be voted upon at the AGM. The result of the vote on each resolution is published on the Company’s website after the AGM and will be announced via the regulatory information service. At the 2020 AGM, shareholders representing over 70.78% of the Company’s issued share capital returned their proxy votes. On behalf of the Board Chris Stone Non-Executive Chair 14 September 2021 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 87 GovernanceGovernance Audit Committee report Ensuring integrity of our financial reporting and internal controls The Committee particularly focuses on systems and processes of management control, the reporting of internal management information and externally reported financial information. Chris Batterham Committee Chair The Audit Committee’s key objectives The purpose of the Audit Committee is to assist the Board in the discharge of its fiduciary duties of stewardship of the Group’s assets. The Committee particularly focuses on systems and processes of management control, and the reporting of internal management information and externally reported financial information. The Committee also provides a forum for reporting by the external auditor. The Audit Committee’s responsibilities The Committee’s main responsibilities include: • Monitoring the integrity of the Financial Statements relating to the Group’s financial performance and their compliance with the provisions of IFRS, the UK Corporate Governance Code, the Disclosure Guidance and Transparency Rules and other regulations • Reviewing material information and significant accounting judgements contained in the Annual Report and Accounts • Advising the Board on the continuing appropriateness of the Group’s existing accounting policies and the application of any new or modified accounting and reporting standards • Advising the Board on the effectiveness of the processes ensuring that the Annual Report and Accounts, when taken as a whole, is fair, balanced and understandable • Reviewing the audit findings with the external auditor including discussing any major issues that arise during an audit, the accounting and audit judgements made, the level of any errors identified during the audit and the effectiveness of the audit process itself 2020/21 key activities • Reviewing SGT progress, and ensuring controls are in place to prevent additional time/cost overruns • Monitoring ongoing impact of Covid-19 on key areas of judgement • Ensuring compliance with new policy on APMs and ISIs • Reviewing a change in accounting policy in relation to the configuration and customisation costs incurred in implementing Software-as-a-Service (SaaS), following the publication of the IFRIC agenda decision in April 2021 2021/22 priorities • Understanding integration plans and associated risks for Iron Mountain’s IPM business as well as monitoring costs of integration • Ensuring adequate controls exist as the Iron Mountain’s IPM business is consolidated into the Group’s results and that the existing Group controls are implemented within the newly acquired business • Ensuring the Iron Mountain’s IPM business fair value accounting including the assessment of deferred revenue is appropriately accounted for and disclosed • Review of SGT progress and time/cost overruns and ensuring any lessons learnt are adequately captured • Planning for regulatory changes arising from the BEIS white paper, “Restoring trust in audit and corporate governance”, and Task Force on Climate-Related Financial Disclosures (TCFD) 88 • Reviewing the effectiveness of the Group’s internal control systems • Received a self-assessment of the finance controls highlighting • Reviewing the nature and extent of significant financial risks and how they can be mitigated • Making recommendations to the Board in relation to the appointment of the external auditor, approving its remuneration and terms of engagement • Overseeing the relationship with the external auditor including, but not limited to, assessing its independence, objectivity and effectiveness • Reporting to the Board on the procedures for responding to whistleblowing, fraud or potential breaches of anti-bribery legislation A full copy of the Committee’s terms of reference can be found in the Investor Relations section of the Group’s website at www.nccgroup.trust/uk/about-us/investor-relations. Activities during the year During the year, the Committee: • Assessed the effectiveness of the 2020 external audit process • Considered and approved updated policies including policies on hedging, functional currencies and Individually Significant Items • Undertook a Committee evaluation exercise to assess where the Committee should best focus its attention • Received a summary of health and safety updates including new initiatives and activities • Considered recent technical updates including guidance issued by the Financial Reporting Council • Following the publication of the April 2021 IFRIC agenda decision, ensured compliance of change in accounting policy regarding configuration and customisation costs incurred in implementing Software-as-a-Service (SaaS). Reviewed associated prior year restatement disclosures • Received regular briefings from the Director of Global Governance summarising risk management and control issues • Reviewed the findings from the internal audit projects conducted during the year and approved the internal audit plan for the forthcoming year • Reviewed the findings from the audit for the year ended 31 May 2021 and from the auditor’s review of the half year results to 30 November 2020 • Reviewed all significant accounting areas and areas of key estimation including specific loss-making contracts and amounts recognised in respect of research and development tax credits. Reviewed KPMG audit conclusions in these areas • Reviewed the application of the Group’s revenue recognition with respect to Managed Detection and Response, a significant growth area for the Group, to ensure accordance with IFRS 15 • Reviewed management’s going concern and Viability Statement assessment, including Brexit and Covid-19 considerations. Reviewed KPMG audit conclusions in these areas • Reviewed the progress of Securing Growth Together and conducted a review of the reasons for any time and cost overruns experienced (e.g. systems implementation) enhancements made during the year, areas of continuous improvement and specific actions to implement minimum control standards • Reviewed a summary of why management considers the Annual Report is fair, balanced and understandable Composition The Audit Committee is chaired by me, a Chartered Accountant of 42 years’ standing. I have previously served as the Finance Director of Unipalm plc, before becoming Chief Financial Officer of Searchspace Limited until 2005. Both businesses operated in digital technology sectors. My earlier career included roles with BICC Group and accountants Arthur Andersen. I also am a member of the audit committee at Blue Prism Group plc and chair the audit committee at Nanoco Group plc (both listed companies) which provides me with additional external perspectives to bring to my chairing of this Committee. The Board considers that I have the recent and relevant experience required by the Code. The other members of the Committee who served throughout the year are Jonathan Brooks and Mike Ettling. All members of the Committee are considered to be independent and the Committee as a whole continues to have competence in the technology sector. Summary biographies of each member of the Committee are included on pages 74 and 75. Meeting frequency and attendance The terms of reference for the Committee require at least three meetings per year. During this financial year the Committee met seven times. As well as the members of the Committee, standing invitations are given to the Chair, the other independent Non-Executive Directors, the Chief Executive Officer, the Chief Financial Officer and the Group Financial Controller, with other attendees also appearing by invitation. The external auditor also attends each meeting. During the year the Committee met, on a number of occasions, with the external auditor without the Executive Directors being present. In addition, following the appointment in early 2020 of the Group’s Director of Global Governance, who heads up the Group’s internal audit function, a number of meetings were held with her without management being present. The attendance of individual Committee members at Audit Committee meetings is shown in the table below: Meetings attended Attendee Chris Batterham Jonathan Brooks 1 Mike Ettling 2 1 Absence due to sudden illness. 2 Absence due to personal circumstances. At all times the Committee remained quorate. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 89 GovernanceGovernance Audit Committee report continued Significant accounting areas and areas of significant management judgement or estimation uncertainty The table below summarises the significant accounting issues, judgements and estimates that the Committee considered during the year in relation to the Financial Statements. These are split between those items which are identified either as recurring items that the Committee regularly reviews or as items of current year focus. The table also sets out the financial context and potential impact of each item as well as the impacted metric. Finally, the table shows the degree of judgement or estimation that the Committee feels has to be applied for each item. Items with a significant impact but with a “low” judgement level will typically have extensive independent third party evidence of the bases for any judgement. Areas assessed as requiring a “high” level of judgement tend to rely more heavily on management estimates and historical trends than extensive independent third party evidence. Review items Goodwill carrying values (recurring) Intangible assets – capitalisation of cloud-based software and development costs (revised) Control of Iron Mountain IPM business (new) Research and development tax credits (new) Long-term loss-making contracts – other estimate (recurring) Accounting judgement Estimation required N/A Yes Yes N/A Yes High N/A N/A High Low Significant issues considered during the year in relation to the Financial Statements During the year, the Committee reviewed and considered the following areas in respect of financial reporting and the preparation of the interim and annual Financial Statements: • The appropriateness of the accounting policies used • Significant areas of management judgement or estimation Goodwill carrying value (Recurring item: see Note 12 to the Financial Statements) The Group has significant balances relating to goodwill at 31 May 2021 as a result of acquisitions of businesses in previous years. The carrying value of goodwill at 31 May 2021 is £182.9m (2020: £193.1m). Goodwill balances are tested annually for impairment. Tests for impairment are primarily based on the calculation of a value in use for each CGU. • The effectiveness and changes to the financial control environment • Compliance with external and internal financial reporting standards and policies This involves the preparation of discounted cash flow projections, which require significant estimates of both future operating cash flows and an appropriate risk-adjusted discount rate. • Disclosure and presentation of GAAP and Alternative Performance Measures (APMs) The commercial viability of individually capitalised development project costs is also part of the overall assessment of carrying values. • Whether the Annual Report and Accounts, taken as a whole, is fair, balanced and understandable and provides the information necessary to assess the Group’s financial position, performance, business model and strategy Future cash flow estimates are based on two critical estimates: the rate of revenue growth and the discount rate, particularly in relation to the Europe Assurance CGU which is the most sensitive to movements in estimates. In carrying out this review the Committee challenged the significant estimates and judgements made by the Group’s finance team and considered the external auditor’s reports setting out its views on the accounting treatments and judgements included in the Financial Statements. The calculation of an appropriate discount rate to apply to the future cash flow estimate is itself an estimate. While some aspects of discount rate calculations can be more mechanical in nature (such as using the 30 year gilt yield as a proxy for the risk free rate) others, such as entity or sector-specific risk adjustments, rely more on management estimates. The discount rate is also a key component in assessing the terminal value which is often an important part of any valuation. Sensitivity analysis on what are regarded as reasonably possible changes is provided in Note 12. 90 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 The Committee has reviewed the rationale used to determine the CGUs including a change in CGUs driven by how the business is managed. The Committee also reviewed assumptions used in future cash flows that underpin the valuation of goodwill, particularly in relation to Europe Assurance since this CGU is the most sensitive to movements in estimates and assumptions. The Committee concurred with the view of management that no impairment should be recognised as either the discounted future cash flows or fair value was higher than carrying value. Intangible assets – capitalisation of cloud-based software and development costs (Revised item: see Note 12 and 34 to the Financial Statements) Where software costs are incurred as part of a service agreement, judgement is required in assessing whether the Group has control over the resources defined in the arrangement. Software development activities involve a plan or design for the production of new or substantially improved products or processes. Judgement is required in determining whether the project is technically and commercially feasible; judgement is required in assessing the future economic benefit and viability of the project. Such judgements are inherently subjective and can have a material impact on determining whether such costs should be capitalised. The total net book value of software and development costs on 31 May 2021 was £5.4m, including additions of £2.3m. The Committee reviews the level of intangible additions and especially how capitalised internal staff time relates to specific assets to ensure alignment with the Group’s policy and is satisfied the policy was applied appropriately for the year ended 31 May 2021. During the year, the Committee has reviewed judgements taken when applying the Group’s new accounting policy in relation to the IFRIC agenda decision regarding configuration and customisation costs incurred in implementing Software-as-a-Service (SaaS). This resulted in a prior year restatement. See Note 34 of the consolidated Financial Statements for further details. The Committee is satisfied with the judgements made for the year ended 31 May 2021. Control of IPM Software Resilience business (Current year focus item: see Note 35 to the Financial Statements) A key judgement in the year ended 31 May 2021 is the acquisition date for the purchase of the IPM Software Resilience business. Management considers shareholder approval of the transaction constitutes a change in control and therefore the date of shareholder approval is considered to be the acquisition date for the transaction. Shareholder approval was granted on 1 June 2021 and the IPM Software Resilience business will be consolidated into the Group results from that date. The Committee has reviewed management’s assessment of the date of change of control of the Iron Mountain IPM business and is satisfied that it is reasonable. Recognition of research and development tax credits (Current year focus item: see Note 9 to the Financial Statements) The tax expense reported for the current year and prior year is affected by certain positions taken by management where there may be uncertainty. The most significant source of uncertainty arises from claims for US research and development (R&D) tax credits relating to historical periods. Uncertainty arises as a result of a degree of uncertainty concerning interpretation of US legislation and because the statute of limitations has not expired. The basis on which the Group has claimed R&D tax credits involves a technical assessment of which party bears the economic risk in any research contracts entered into with third parties. This assessment is a key estimate. It is considered “probable” that the US taxation authority would accept the uncertain tax treatment in relation to the utilised tax credits recognised. For the periods ending 31 May 2017 to 31 May 2021, the aggregate net current tax benefit included in the Income Statement relating to the R&D tax credits is £2.7m (2020: £4.3m). The gross deferred tax asset relating to the R&D tax credits is £1.0m, although due to the uncertainty we have made a provision of £0.6m against this asset. The aggregate gross amount of US R&D tax credits recognised amounts to £8.2m (2020: £5.1m) and we have made a provision of £5.1m (2020: £0.8m) against this gross position. Sensitivity analysis on what are regarded as reasonably possible changes is provided in Note 2. The Committee has reviewed management’s assessment of US R&D tax credits together with an independent third party review assessment and is satisfied the estimate made is reasonable and consistent with IFRIC 23 ‘Uncertainty over Income Tax Treatments’. Loss-making contracts – other estimate (Recurring item: see Note 21 to the Financial Statements) Some aspects of the Group’s revenue are derived from relatively long-term fixed price contracts. On this basis, an estimate is disclosed in relation to one contract: • An onerous provision recognised during the year ended 31 May 2020 of £0.2m has increased during the period by a further £1.9m, of which £1.7m has been utilised leaving a closing balance of £0.4m of a total provision for loss-making contracts of £1.1m (see Note 21). This additional provision relates to a European contract and has been caused by Covid-19 disruption and some project management challenges during the year. Management prepares projections, which, due to the complexity of the contract, require estimates and accounting judgement of both revenue and cost recognition (including the number of performance obligations). Revenue is recognised based on the input method of IFRS 15 in relation to total costs and therefore management has to estimate the number of hours still required to complete the long-term projects and labour cost to complete. Sensitivity analysis on what are regarded as reasonably possible changes is provided in Note 2 The Committee reviewed and challenged the assumptions underpinning this accounting treatment and is satisfied that the contract has been correctly treated, and that in the case of the loss-making contract the liabilities recorded are reasonable. The Group’s approach to materiality In considering the materiality of any individual issue or issues in aggregate, the Group looks at a range of qualitative and quantitative measures to assess whether or not omitting, misstating or obscuring information could reasonably be expected to influence decisions that the primary users of general purpose financial statements make on the basis of those financial statements. The range of measures includes (but is not limited to) the primary Financial Statements themselves, the individual line item in question, and whether or not the issue moves the result from one side of an inflection point to another (for example, turning a profit into a loss or a net asset into a net liability). Qualitative and quantitative measures are both considered as is any potential impact on remuneration or banking arrangements such as debt covenants. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 91 GovernanceGovernanceAudit Committee report continued Internal audit The internal audit function is responsible for internal audit, the assurance of other quality systems and processes, and monitoring the embedding of risk management processes throughout our operations. The internal audit plan was approved by the Committee during the financial year and a number of audits were performed, the findings of which have been reviewed by the Committee. During the year, eight internal audit reports were issued. The Group will look to increase the scope of the audit plan during FY22, drawing on third party resource provided under co-source arrangements, and through the use of data analytics. Internal controls and risk management The Board is responsible for establishing, maintaining and monitoring the Group’s system of risk management and internal control and reviewing its effectiveness. The Committee monitors the performance of management in this area. We have an ongoing process for identifying, evaluating and managing the principal risks faced by the Group which has been in place for the year under review and up to the date of approval of the Annual Report and Accounts. The Group’s non-cyber security risks are monitored by the Audit Committee on behalf of the Board which sets aside time for an in-depth discussion of notable or changing risks to the business. A description of the process for managing risk together with a description of the principal risks and strategies to manage those risks is provided on pages 40 to 48. Cyber risks are reviewed by the Cyber Security Committee; the Cyber Security Committee Report can be found pages 98 and 99. Internal control systems are designed to meet the particular needs of the Group and the risks to which it is exposed. By their nature, however, internal control systems are designed to manage rather than eliminate the risk of failure and can provide only reasonable but not absolute assurance against material misstatement or loss. During the year, the Group has implemented new systems which have brought about some changes in controls, as the Group transitions away from historic systems. These controls will require further changes in the forthcoming year as we continue to embed new ways of working across all our systems. Key elements of the risk management and internal control system are described below. Enhancements during the year are highlighted while the other elements have all been in place throughout the year. Controls relating to financial reporting and preparation of the Annual Report and Accounts • Information provided to management covering financial performance and key performance indicators, including non-financial measures (enhanced by new KPIs and targeted management reports) • A detailed budgeting process where business units prepare plans for the coming year (enhanced with new standardised reporting, discretionary cost reviews and consolidation models and systems) • Procedures for the approval of capital expenditure and investments and acquisitions (enhanced by standardised capital approval request forms) • Monthly operational reviews to monitor and reforecast results as required against the annual operating plan, with major variances followed up and management action taken where appropriate Other controls • Defined management structure and delegation of authority to Committees of the Board, subsidiary boards and associated business units (enhanced by more detailed authorities and guidance notes) • Recruitment standards and training to ensure the integrity and competence of staff • Anti-bribery, security and compliance training for all colleagues • Clearly documented internal procedures set out in the Group’s ISO 9001:2015 accredited quality manual • Regular internal audits of key processes and procedures under the Group’s ISO 9001 and ISO 27001 accredited quality assurance process • Monitoring of any whistleblowing or fraud reports The external auditor regularly reports its findings on those areas of internal control which it assesses as part of the external audit and half year review to the Board and the Audit Committee. Our internal control effectiveness is assessed through the performance of regular checks, which in the year ended 31 May 2021 included: • Assessment of the identification and management of risks connected to the Group’s strategy and management of strategic change • Reviewing and testing the Group’s financial reporting processes • Performing compliance monitoring activities • Assessment of the Group’s processes for identifying and mitigating potential conflicts of interest • Monitoring the completion of the Group’s mandatory colleague training 92 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Whistleblowing and confidential reporting procedures The Group operates a confidential reporting and whistleblowing procedure (known as our “Whistleblowing Policy”). The policy aims to support the stewardship of the Group’s assets and the integrity of the Financial Statements as well as protecting colleague welfare. The procedure is reviewed annually by the Committee to ensure that it remains fit for purpose. The Group has appointed an independent third party reporting agent to be the first point of contact for those who do not wish to use normal internal line management channels for reporting their concerns. This is advertised internally via colleague noticeboards and our intranet. During the year, the Code of Ethics Policy was updated and all colleagues were asked to undertake refresher training. As part of this training, colleagues were reminded of the existence of the Whistleblowing Helpline. The Committee reviews any whistleblowing or confidential reporting of concerns raised during the year with respect to their nature, scale and any associated or consequential risks. Review of the Audit Committee’s effectiveness The Committee has reviewed and considered the effectiveness of its performance during the year. The review included the views of members of the Committee and of regular attendees at the various meetings (including the Executive Directors). I am satisfied that the degree of rigour and challenge applied in performing the Committee’s responsibilities is appropriate and effective and continues to improve. Please see page 84 for further details of the Committee evaluation process. Auditor’s independence and objectivity The Committee received a formal statement of independence from the external auditor. The Company also operates a rigorous policy designed to ensure that the auditor’s independence is not compromised by it undertaking inappropriate non-audit work. The Audit Committee’s approval is therefore required for any fees for any non-audit work undertaken by the auditor. However, the Company recognises that it can receive particular benefit from certain non-audit services provided by the external auditor due to its technical skill and detailed understanding of the Company’s business. During this financial year non-audit fees of £75,000 (2020: £50,000) were paid to the external auditor for the half year review. All significant pieces of non-audit work are put to informal tender to suitable parties that, if appropriate, can include the external auditor. Upon review as to suitability and price, the work will then be placed with the service provider recommended. If this is the external auditor, then Audit Committee approval is required. The external auditor was not engaged during the year to provide any services which may have given rise to a conflict of interest. The Committee is satisfied that the overall levels of audit and non-audit fees (i.e. the half year review fee) are not material relative to the income of the external auditor as a whole and therefore that the objectivity and independence of the external auditor were not compromised. External auditor’s effectiveness and appointment The Committee reviews and makes recommendations regarding the reappointment of the external auditor following a formal review of the auditor’s performance following completion of the prior year Financial Statements’ audit. In making these recommendations the Committee considers: • The experience, industry knowledge and expertise of the auditor • The scope and planning of the audit and any variations from the plan • The quality of the processes adopted • The auditor’s explanations of significant risks to audit quality by reference to the Company’s specific circumstances and changes to the risks, including Covid-19 implications • The fees charged • Its attitude to and handling of key audit judgements • Its ability to challenge and communicate effectively with management • The quality of the final report • The FRC’s Audit Quality Review report relating to KPMG During the financial year, I attended regular meetings with KPMG’s engagement partner without management being present. This provided the opportunity for open dialogue. The engagement partner demonstrated her understanding of the Group’s business risks and the consequential impact on the Financial Statements. Feedback on the conduct of the audit from the engagement partner’s perspective is used to determine if any challenges in the prior year audit would be sufficiently addressed in the next audit cycle. The Group’s current auditor, KPMG LLP, has been in place since 1 November 2013 with a competitive audit tender process having last been undertaken in November 2011. Frances Simpson has replaced Mick Davies as KPMG’s engagement partner for the year ended 31 May 2021. The lead audit partner rotates at least every five years to ensure independence. The Group will continue to keep this position under review during the new financial year. The Group intends to remain in full compliance with the requirement to carry out a formal tender at least once every ten years; therefore, a formal tender is expected to be undertaken before November 2023. Therefore, having fully considered the effectiveness, independence and objectivity of the external auditor and the reports it has produced in the current financial year, the Committee has concluded that it is appropriate to recommend to the Board the reappointment of KPMG LLP as the Group’s external auditor for the next financial year. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 93 GovernanceGovernanceAudit Committee report continued 1 Financial information 4 Audit Committee Chair 2 Narrative disclosures 3 Independent reviewers Fair, balanced and understandable The following process was followed by the Committee in making its assessment: 1. Financial information • Prepared by individual business units • Consolidated by Group finance team • Reviewed by Group Financial Controller and CFO 2. Narrative disclosures • Prepared by Group finance team • Reviewed by Group Financial Controller and CFO • Various reports prepared by Committee Chairs, CEO and CFO 3. Independent reviewers • Senior members of the Executive Committee or other senior colleagues • Those who have not been major contributors 4. Audit Committee Chair • Review of detailed verification documents • Review of findings and observations from independent reviewers Related party transactions and other fees approved by the Committee Refer to Note 32 for related party transactions in the year. There were no such fees payable in the current year. Fair, balanced and understandable At the request of the Board, the Committee considered whether the 2021 Annual Report and Accounts, when taken as a whole, was fair, balanced and understandable (FBU) and whether it provided the necessary information for shareholders to assess NCC Group’s position and performance, business model and strategy. The reviews outlined in the diagram above include reviews of all material matters, as reported elsewhere in this Annual Report and Accounts, and reviews of the balance of good and bad news and ensure the Annual Report and Accounts correctly reflects: • The Group’s position and performance as described on pages 9 to 13 and 32 to 39 • The Group’s business model as described on pages 20 and 21 • The Group’s strategy as described on pages 29 to 31 The independent reviewers were not major contributors to the Annual Report and Accounts but, at the same time, as members of the Executive Committee or other senior colleagues, are deemed to be sufficiently well informed on the Group’s activities to be able to give appropriate feedback on the FBU criteria. They undertake a qualitative review of disclosures and a review of internal consistency throughout the Annual Report and Accounts. The Directors’ statement on a fair, balanced and understandable Annual Report and Accounts is set out on page 123. Chris Batterham Chair, Audit Committee 14 September 2021 94 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Nomination Committee report An increased focus on succession planning for the Board and senior management During this year we have made the formal commitment that by 2024, we will have at least 33% female representation on our Board and at least one person of colour. Although this is best practice for FTSE 350 companies, we will commit to this target regardless of which share index we are in. Chris Stone Committee Chair The members of the Nomination Committee are Chris Batterham, Jonathan Brooks and Jennifer Duvalier along with me. The Nomination Committee’s objectives and responsibilities The Nomination Committee is responsible for reviewing the size, structure, balance, composition and progressive refreshing of the Board and its Committees and as such its duties include: 2020/21 highlights • Session to review senior management and Executive Director succession plans • Focused on diversity and inclusion in every meeting, including undertaking unconscious bias training • Undertook a review of the colleague engagement results and continued with the non-executive colleague engagement sessions 2021/22 priorities Our priorities for the coming year focus on three areas: • Broadening our approach to talent and succession • Reviewing the structure of the Board enabled by Workday • Continuing to support the development of a diverse leadership profile and pipeline • Creating the right working environment to support colleague engagement and working post pandemic • Evaluating the balance of skills, knowledge, experience and diversity on the Board • Making recommendations for further recruitment to the Board or proposing changes to the existing structure of the Board, or individual Directors • Reviewing the leadership needs of the Company, both Executive and Non-Executive • Succession planning for Directors and other senior executives within the business • Recruiting, appointing and exiting of Directors • Overseeing membership of, and succession to, the various Board Committees • Reviewing the time commitment required from the Non-Executive Directors on NCC Group business 95 GovernanceGovernanceNomination Committee report continued The Nomination Committee’s objectives and responsibilities continued The Chair of the Board leads the process for the appointment of new Non-Executive Directors to the Board and for the appointment of the Chief Executive Officer. The Chief Executive Officer, in conjunction with the Chair, leads the process for the Chief Financial Officer. The Senior Independent Director leads the process for a new Chair of the Board. In relation to an appointment to the Board, the Committee draws up a specification and assesses the capabilities and experience required for such a role, taking into account the Board’s existing composition, including relevant experience and understanding of our stakeholder groups. We will look to address this during future Board and Executive Committee appointments to improve our diversity. Given that this is a fairly young Board in terms of tenure, this improvement in diversity will not be a quick process but we are very mindful of the need to improve this and take positive action, and the matter is fully on our agenda. Accessing the candidates we require to reach this target will involve us looking beyond the obvious, for example existing board directors within the UK, and we intend to ensure that we extend our talent search to other sectors and countries to ensure we find a diverse pool of candidates from which to choose from. When a new Director is appointed they receive a full, formal and tailored induction into the Company and discuss with the Chair any immediate training requirements. We also assess the time commitment required. Candidates are sought by third party executive search consultants and, where appropriate, through the assessment of internal candidates and are then formally considered by the Nomination Committee. Extensive external referencing is completed. The Committee’s terms of reference can be found in the Investor Relations section of the Company’s website: www.nccgroupplc.com/investor-relations. The terms of reference are reviewed annually and updated when necessary. Diversity Our objective is to have a broad range of skills, backgrounds, experiences and personal attributes within the Board as this ensures the Board is best placed to serve the Company. All appointments are made on merit and against objective criteria with due regard for the benefits of diversity on the Board, including gender, nationality, and educational and professional background, as well as individual characteristics which will enhance diversity of thinking on the Board. The Company and the Committee value the aims and objectives of the Hampton-Alexander Review on FTSE women leaders and the Parker Review on ethnic diversity of UK boards and support and apply the Group’s diversity policy. The Group’s gender diversity statistics are set out on page 63. At Board level, we currently have one female on our Board and no people of colour, but we note that diversity extends beyond the measurable statistics of gender and ethnicity. As such, while we historically have not set any particular targets, we continue to take diversity in its wider context into account, having regard to the diversity policy, and recommend only the most appropriate candidates for appointment to the Board. That said, we recognise that we still have much progress to make in terms of improving the diversity of the Board and our Executive Team (and indeed our workforce as a whole). With that in mind, during the year we have made the formal commitment that by 2024, we will have at least 33% female representation on our Board and at least one person of colour. Although this is best practice for FTSE 350 companies, we will commit to this target regardless of which share index we are in. (To achieve this commitment by 2024 based on our current Board size of seven Directors, we would need to have at least three female Directors out of the seven. At least one of the seven would be a person of colour.) Committee meetings During this financial year, the Committee held three scheduled meetings. The attendance of individual Committee members at Nomination Committee meetings is shown in the table below. Unless otherwise indicated, all Directors held office throughout the year. Meetings attended Attendee Chris Stone Chris Batterham Jonathan Brooks Jennifer Duvalier Activities during the year During the year, the Committee: • Evaluated the skills, knowledge and experience around the Board table • Reviewed the structure, size and composition of the Board • Reviewed the Directors’ length of service • Reviewed the diversity of the Board • Reviewed the memberships of all Committees • Reviewed the expected time commitment of the Chair and the Non-Executive Directors During the year, the Nomination Committee has had several in-depth presentations from the Chief People Officer and the Global Head of Learning and Development which focused on people, talent and succession planning. These presentations looked at the overall current position and in particular senior succession, i.e. the Executive Committee and its direct reports. 96 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 One presentation also described a roadmap to a 2022 future state where we wish to be a “destination employer with a quirky, distinctive environment”. In terms of our ongoing focus on improving diversity, we are focusing on: Processes • Reviewing all our processes/documentation as part of our Workday system go-live – i.e. ensuring the wording on adverts and job descriptions is gender neutral • Providing better tracking and reporting at all points of the colleague cycle to check for bias Training • Introducing a Manager Essentials programme which covers recruiting and managing a diverse team • Providing unconscious bias training for leadership groups (the Board and ExCom have both now undertaken unconscious bias training). Participated in NCC Conversations – promoting equality Colleague voice • Continuing to develop and assess the broad range of opportunities for colleagues to ask questions, to provide feedback and to play an active role in creating a great place to work. (For further information, please see the stakeholder engagement section on pages 49 to 52) Long term • Building strategic partnerships with organisations to support our commitment to create an inclusive and diverse environment • Connecting the initiatives we are involved in so we get the best return for investment – work experience, mentoring and CyberFirst bursaries Committee effectiveness During the year, the Nomination Committee carried out an internal self-evaluation on its effectiveness. A number of recommendations were made, including the need to: • Make strong initial progress with our firm commitment to have at least 33% female representation and at least one person of colour on the Board by 2024 • Focus strongly on succession planning for the Board and senior management and in particular discuss Executive Director succession planning in general terms over the next 6–12 months • Improve succession plans for senior executives and improve exposure to senior executives at Board meetings and within more informal settings The intention is to again have a Committee discussion on all senior roles during the 2021/22 financial year, to ensure that we have the depth and breadth of diverse talent to deliver our strategy. External search consultancies No external search consultancies were utilised in the year. Chris Stone Chair, Nomination Committee 14 September 2021 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 97 GovernanceGovernanceCyber Security Committee report Maintaining and improving the Group’s resilience to cyber-attack as the threat landscape changes Through the Committee, the Group continues to review and challenge the data governance and information security risks that affect the Group, particularly in light of the “move to remote” during the Covid-19 pandemic and the changing regulatory landscape post-Brexit and Schrems II. Chris Stone Committee Chair The Cyber Security Committee was formed to focus specifically on the cyber risks faced by the Group. This reflects the significant threat posed by cyber risks, the nature of our business, and the potential damage to the business as a high value target for malicious acts. The Committee’s activities aim to challenge and support improvements to the Group’s information security and data protection policies, defences and controls, so as to comply with global data protection regulations around the world, and ensure that the Group looks after its own information, and the information that its customers entrust to it, with the proper care and attention. The Committee was formed in November 2016 and I have been Chair since January 2018. Chris Batterham, Jonathan Brooks and Jennifer Duvalier (all independent Non-Executive Directors) served as members of the Committee throughout the year. The Group’s Director of Global Governance, the Group’s Chief Information Security Officer (CISO), and the Group’s Chief Data Protection and Governance Officer (CDPGO) are standing invitees of the Committee. The Executive Directors are invited to attend Committee meetings when the Committee considers it to be appropriate. The Cyber Security Committee’s objectives and responsibilities The Cyber Security Committee is responsible for assessing the performance of the Group’s internal security and defences and as such its duties are to: • Oversee and advise the Board on the current cyber risk exposure of the Group and future cyber risk strategy • Review at least annually the Group’s cyber security breach response and crisis management plan • Review reports on any cyber security incidents and the adequacy of resulting actions 2020/21 highlights • Enhanced SOC coverage and detection capabilities across our network • Extending our Microsoft Defender for Endpoint rollout; implementation of remote application patching capability • Development of a Data Protection by Design framework, including new and revised policies, procedures and guidance • Global risk management framework initial implementation and rollout 2021/22 priorities • Running more complex cyber exercises to test our response processes • Implementing a new security awareness platform across NCC Group globally • Implementing a system to facilitate dynamic maintenance of Records of Processing across the NCC Group business • Implementing the Data Protection by Design framework across NCC Group globally 98 • Receive and consider the regular update reports from the CISO and CDPGO and ensure the CISO and CDPGO are given the right of direct access to the Committee • Consider and recommend actions in respect of all cyber risk issues escalated to it • Keep under review the effectiveness of the Group’s controls, services and products to analyse potential vulnerabilities that could be exploited • Regularly assess what are the Group’s most valuable intangible assets and the most sensitive Group and customer information and assess whether the controls in place sufficiently protect those assets and information • Review the Group’s ability to identify and manage new cyber risks • Assess the adequacy of resources and funding for cyber security defence and control activities • Regularly review the cyber risk posed by third parties including outsourced IT and other partners • Oversee cyber security due diligence undertaken as part of an acquisition and advise the Board of the risk exposure • Annually assess the adequacy of the Group’s cyber insurance cover The Committee’s terms of reference can be found in the Investor Relations > Corporate Governance section of the Company’s website (www. nccgroupplc.com/investor-relations/corporate-governance). The terms of reference are reviewed annually and updated when necessary. Committee effectiveness During the year, the Cyber Security Committee carried out an internal self-evaluation on its effectiveness, as it continues to mature since its formation in November 2016. The Committee was found to be working effectively and I am satisfied that the degree of rigour and challenge applied in performing the Committee’s responsibilities is appropriate and effective and continues to improve. In terms of specific focus areas for the year ahead we agreed on the following: • Continuing to take the papers/presentations as read and focusing on more value-adding dialogue, discussion, and interaction rather than going through the Committee briefing packs • Acknowledgement that the presenter from the National Cyber Security Centre had been excellent and more external presenters should be used where possible • A review of whether external advisers/consultants could attend future Committee meetings • More frequent updates on the nature of the changing cyber threat landscape, e.g. what are the current major topics within cyber and the significant threats As an output of both this and previous evaluations, the Committee, along with the Board, reaffirmed that cyber security is a sufficiently important risk for the business that the Committee should remain focused on this specific set of risks. Therefore, the current structure in which the responsibility for broader risk management remains with the Audit Committee will continue. Committee activities during the year The Committee continues to make sure that the Group’s resilience to cyber-attack is maintained and improved as the threat landscape changes. As the Securing Growth Together programme comes to its latter stages, more focus was put on longer-term initiatives that will stand the Group in good stead in the years to come. In November, the Committee had a fascinating talk from the Director of Operations at the UK’s National Cyber Security Centre (NCSC), about the NCSC’s perception and analysis of the cyber threat that faces the UK. The Group continues to improve its cyber security controls. Building on our initial rollout of Microsoft Defender for Endpoint in 2020, we extended this to servers as well as endpoints, giving us ever-deeper security insight into our IT assets. In addition, we invested in technology that allows us to patch application software on endpoints in a more automated way across the internet, rather than requiring a VPN connection. Both of these controls stood us in good stead during the coronavirus pandemic, when almost all colleagues were working remotely. Our SOC implemented its latest detection suite across our networks, and we continue to benefit from novel detection methods and techniques as the SOC’s “customer zero”; as those detection techniques are refined, they are rolled out into our commercial offering. In terms of our global data protection programme and internal data privacy activities, we are developing a three year strategy to align the approach across the business, continue to improve our privacy maturity, and support in light of the rapidly changing regulatory landscape. Considerations include the newly approved Standard Contractual Clauses and their requirement for detailed information security provisions to be documented for each service line, as well as updating internal agreements to secure our global business in terms of facilitating data transfers. Noteworthy highlights since our previous report include: • A suite of tools has been created to enable Data Protection by Design to continue, and to make the assessment process more efficient and easier for the business to engage with. These include a Data Protection Impact Assessment (DPIA) triage form, and DPIA light and DPIA full templates, with guidance also produced. The data protection team has been working closely with IT to embed this into its processes • The expansion of the data protection and privacy team’s remit to encompass data governance, including the appointment of Data Protection Officers to partner with North America and APAC, respectively, with appointment of a Data Protection Manager in NCC Europe, headed up by the Chief Data Protection and Governance Officer • Bespoke gap analysis tool created covering all principles and articles within GDPR, which flexes to accommodate the complexity of our different business areas/service lines • Assessment of the situation with the UK adequacy decision and the additional safeguards required to ensure the free flow of data from the EU to the UK should adequacy be revoked, as well as planning for the impact of the recent issue of the new Standard Contractual Clauses by the EU Commission Committee meetings During this financial year, the Committee met three times and the attendance of individual Committee members at the Cyber Security Committee meetings is shown in the table below. Unless otherwise indicated, all Directors held office throughout the year. Meetings attended Attendee Chris Stone Chris Batterham Jonathan Brooks 1 Jennifer Duvalier 1 Was absent for July 2020’s meeting due to illness. Chris Stone Chair, Cyber Security Committee 14 September 2021 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 99 GovernanceGovernance Remuneration Committee report Annual statement Looking beyond the pandemic Our new Remuneration Policy will balance an increase to variable remuneration with a reduction in the threshold vesting level for the LTIP and an increase to the toughness of the LTIP’s stretch EPS target. At the same time, if the new Policy is approved, we will immediately reduce Executive Director pension contributions to the workforce level of 4.5%, and adopt a more demanding post-employment shareholding policy. Jonathan Brooks Committee Chair On behalf of your Board, I am pleased to present our Directors’ Remuneration Report (DRR) for the year ended 31 May 2021. The report is divided into three sections: an Annual Statement, our Directors’ Remuneration Policy and the Annual Report on Remuneration, which sets out the actual application of the Policy. Annual Statement 2020/21 was another busy year for the Remuneration Committee and we had seven meetings in total. The Committee, which remained unchanged for the third year in succession, comprised Chris Batterham, Jennifer Duvalier and me as Chair. Our Board Chair, Chris Stone, also attended all the meetings. We invited our remuneration consultants, Chief People Officer, CEO, CFO, and other executives to meetings as required. Consultation with shareholders following 2020 AGM The arrival of the Covid-19 pandemic at the start of 2020 obliged us to wrestle with the immediate impact to our business of a significant period of uncertainty. The impact of the pandemic fell late on in the financial year and it was immediately apparent that forecasting the financial effects for both the end of the 2019/20 financial year as well as the 2020/2021 financial year would be extremely difficult, although we are pleased that we did not furlough any staff, make any staff redundant or reduce our dividend. As a Committee, and mindful of the desire to keep colleagues appropriately rewarded for their performance and incentivised to deliver the best outcomes for our shareholders during such a difficult period, we took some immediate action to address this period of uncertainty. Firstly, we 2020/21 highlights • Consultation with shareholders following the 2020 AGM • Development of Remuneration Policy for 2021–24 and a second consultation with shareholders • Launch of a new Restricted Share Plan to broaden colleague share ownership 2021/22 priorities • Implement our new Remuneration Policy following approval at the AGM • Integrate Iron Mountain remuneration practices into the Group • Consider the introduction of ESG measures • Continue to ensure our incentive arrangements support the Group’s long-term strategy * The Directors consider that Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements is comparable to Adjusted operating profit previously reported. See Strategic Report for further details and a reconciliation between Adjusted operating profit of £39.2m and Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements of £36.2m. 100 applied our discretion and replaced the formulaic assessment of the financial underpin to the non-financial element of the 2019/20 bonus with a non-formulaic assessment. Secondly, we decided that the non-financial element of the annual bonus for 2020/21 should have a weighting of 40% of the total, compared with the previous year’s figure of 25%. Thirdly, we decided that for 2020/21, we would divide the year in two for bonus target setting purposes, with one set of bonus targets based on the first six months’ performance and a revised target being set for the second half of the year. While many shareholders recognised this pragmatic approach, we were disappointed that a significant minority of others voted against our Annual Remuneration Report in 2020. Immediately after the AGM, I therefore engaged with all major shareholders who voted against the resolutions to better understand their reasons for doing so. There were two main reasons which explained their objections: some did not feel that the application of discretion during the year to replace the annual bonus profit underpin for 2019/20 was appropriate, while others did not support the increased weighting on non-financial measures in the annual bonus from 25% to 40% for 2020/21. The Remuneration Committee acknowledged these views in its statement in early February 2021, and whilst it still considers its decisions were appropriate and pragmatic in the exceptional circumstances of the pandemic, emphasised that the weighting on non-financial measures in the annual bonus would revert to 25% of the total in 2021/22 and that a profit underpin would be applied in future. Development of Remuneration Policy for 2021–24 and separate consultation with shareholders During the 2020/21 financial year, we operated within the Remuneration Policy that was approved by shareholders at the 2020 AGM. With the arrival of the Covid-19 pandemic, changes to the Remuneration Policy last year were minimal and we flagged at the time that we planned on submitting a new Policy this year. The aim of these changes was to reflect the strong performance of the business and development of the senior team over a number of years and ensure that the remuneration of our senior team is appropriately positioned against a highly competitive market for talent within the sectors in which NCC Group operates. We refined some changes with our remuneration consultants and then undertook a period of consultation with shareholders in March and April 2021, who were supportive of our approach. Our proposed new Remuneration Policy can be found in the next section of this report and will be voted upon at our AGM in November. Its main features are to make phased increases to the variable pay opportunity for our CEO and CFO. The first of the proposed changes will take place in 2021/22 and increase the level of LTIP from 100% of salary to 175% and 150% of salary for the CEO and CFO, respectively. Implementation of the second increase will be take place in 2022/23 when the annual bonus opportunity for both the CEO and CFO will increase from 100% to 125% of salary. The Committee considers this phased approach to be appropriate in the current environment and these increases will be balanced by a reduction in the threshold vesting level for the LTIP and an increase to the toughness of the LTIP’s stretch EPS target. At the same time, if the new Policy is approved, we will immediately reduce their pension contributions to the workforce level of 4.5% and adopt a more demanding post-employment shareholding policy. The overall effect of these changes will result in levels of total remuneration that are at or below the market level. Further details can be seen in the next section of the report. With respect to base pay, for the 2020/21 financial year, average salaries in the Group rose by approximately 2.9% but we decided to increase the salary of the CEO and CFO by 1% to take effect from September 2020. For 2021/22, salaries increased by an average of 3.1% and we increased the CEO’s salary by 3%, taking his base salary to £465,000 with effect from 1 June 2021. For the CFO, recognising that his salary is well below the level that the Committee considers to be appropriate given his performance and experience in the role, we consulted with shareholders to increase his pay over a two year period. In June 2021 his salary increased to £308,000, representing an increase of 4.9% above the average workforce increase (i.e. 8% in total). In June 2022, we also intend to increase his salary by up to 3% above the average workforce figure. While these increases will still result in a below market salary, when combined with the proposed increases to variable remuneration this should bring his overall remuneration closer to market levels. Launch of a new below Board Restricted Share Plan to broaden colleague share ownership As a Board, we remain committed to broadening share ownership throughout the Group, both as a reward and retention tool. During the year, we introduced our Restricted Share Plan (RSP), authorisation for which had been granted at the 2020 AGM. An increased number of colleagues were made a share award dependent on their continuing service within the Group for a period of up to three years. RSPs are extremely common in the technology sector in the USA, where we have increased our presence in the last few years, and we expect to issue more RSPs annually. In addition, we also offered colleagues the opportunity to participate in our Save As You Earn/stock purchase share plans in the UK, the US, Canada, the Netherlands, Australia, Denmark and Spain. Once again, these proved popular in terms of take-up and participation levels. Non-Executive Director and Chairman’s fees In line with our Remuneration Policy, Non-Executive Director fees are reviewed annually. During the year, the Non-Executive Director fees were reviewed (by the Company Chair, CEO and CFO) and increases were proposed with effect from 1 June 2021, being the first increases for three years. In addition, as social distancing restrictions are being progressively removed it was decided to reinstate the travel expense allowance with effect from 1 June 2021. This had been withdrawn in March 2020 at the start of the pandemic when physical Board meetings were not possible. The Remuneration Committee also reviewed the Chairman’s fees using data provided by our remuneration consultants. As a result the Chairman’s fees were increased for the first time since his appointment in 2017. Details of these fees and allowances are given in the Annual Report on Remuneration on page 110. Performance related pay – bonus The annual bonus for the year ended 31 May 2021 for both the Chief Executive Officer and Chief Financial Officer was based on the satisfaction of stretching financial and strategic targets. This resulted in an overall payment of 92% of base salary for the CEO and 87% of base salary for the CFO. With respect to the financial targets, as we reported in the Annual Report 2020, in light of the impact of the pandemic and the difficulty in estimating its short-term impact on the business, we decided to divide the 2020/21 financial year into two, with the first six months of the year qualifying for up to a 30% financial bonus if the half year Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements * achieved £17.0 million, with the financial target for the second half of the year being based on a reforecast which took place in November 2020, and an Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements * of £19.0m being required for a further 30% bonus. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 101 GovernanceGovernanceRemuneration Committee report continued Annual statement continued Performance related pay – bonus continued The targets for both halves of the 2020/21 financial year, were exceeded, resulting in a total financial bonus for the year of 60%, the maximum for this element. For the 2020/21 financial year, the strategic objectives for both the CEO and CFO were given a weighting of 40% in total. The bonus earned was judged to be 32% for the CEO and 27% for the CFO. The strategic objectives covered three areas: • Broadening the product portfolio: the broad objective was to offer the complete portfolio of products and services tailored to specific customer sectors and to be able to deliver this globally. This was broken down by market with specific revenue objectives for different products (20%) • Sustainability: to act as a responsible corporate citizen to ensure our future. This included objectives with respect to training of future leaders in the Group, diversity targets for recruitment, the development of action plans to improve engagement with underrepresented groups and the assessment of customer and colleague experience (10%) • Specific improvements and efficiencies: these were delivered through strategic programmes with the objective of placing data and process re-engineering at the heart of the business and included the development of global support functions and certain identified key hires, as well as specific global product lines (10%) Further detail on performance against strategic objectives is provided later in the report. For both the CEO and CFO, 35% of the actual bonuses achieved will be deferred into nominal cost share options and will vest after two years. Clawback and malus provisions are also in place for the annual bonus. For 2021/22, the Committee will change the annual bonus weightings back to its more normal weightings of 75% financial and 25% non-financial. For the financial bonus, as in previous years, it will be set within a tight range with bonuses between 15% and 75% of base salary being calculated by linear interpolation. For 2021/22, we will introduce a revenue target component for both the Assurance and Software Resilience businesses to complement the targets on Adjusted operating profit. Strategic targets for 2021/22 For the CEO, the strategic targets will be grouped under the following broad headings: • Integration of Iron Mountain IPM division: this will include specific targets for systems, people, customer and operating model integration (10% in total) • Strategic objectives within the Assurance business: these will include specific targets for the development of the MDR and Remediation businesses (10% in total) Performance related pay – LTIP The grant of the 2020–23 LTIPs was delayed as a result of extended prohibited periods including those connected to the acquisition of the Iron Mountain IPM division, as a result of which the grants which would ordinarily have been made in the autumn of 2020 were not made until May 2021. The awards will vest subject to demanding EPS, cash and relative TSR targets outlined later in this report. The LTIP outcome for those LTIPs issued in 2018 was an award equivalent to 40% of the maximum award, which in the case of the CEO constituted an award of 78,914 shares, and the CFO constituted an award of 49,779 shares. Our LTIP award for 2021–24 will be granted after our next AGM in November and subject to shareholder approval of the revised Remuneration Policy, the Committee intends to make awards of up to 175% of base salary for the CEO and 150% for the CFO compared to 100% of base salary for both executives as at present. These will vest after three years as long as a number of demanding performance targets are satisfied. As in previous years, 60% of the potential award will be based on the achievement of a demanding EPS target, 30% on the achievement of certain cash targets and 10% on relative TSR targets. We plan to issue LTIPs to the Executive Directors shortly after the 2021 AGM in November 2021. Clawback and malus provisions are in place for the LTIP. In order to further align executives with shareholders, executives are required to retain any LTIP vested shares (net of tax) for a period of two years. After this holding period, all vested shares must also be retained if the shareholding requirement has not been met. In addition, our new post-employment shareholding policy requires executives to retain the lower of the value of their holding on cessation or 200% of salary for the first year following cessation, reducing to 100% of salary for the second year following cessation. It is envisaged that this will be managed through a restricted account maintained by NCC’s registrars and the Company Secretariat. At the AGM in October 2020, 51.53% of shareholders voted in favour of the adoption of the Annual Report on Remuneration. The 2021 Annual Statement and Annual Report on Remuneration will be put to an advisory vote at the AGM on 4 November 2021, providing shareholders with the opportunity to express their support on how the Committee has implemented the Remuneration Policy this year. As always, the Committee remains committed to engagement and transparency and I welcome the opportunity for discussion of the Group’s remuneration with any shareholder, at our AGM or at any other time during the year. During the coming year, we intend to focus on embedding our 2021–24 Remuneration Policy along with continuing to focus on the Committee’s responsibilities under the 2018 UK Corporate Governance Code (the ‘Code’). These include: • Sustainability objectives: these will include objectives with respect to diversity targets, colleague retention in certain areas, and corporate social responsibility (5% in total) • Ensuring that the Remuneration Policy continues to support and incentivise the achievement of our strategy and considering the incorporation of ESG measures For the CFO, the strategic objectives will be similar but, instead of strategic objectives within the Assurance business, he will have objectives related to the effective configuration and optimisation of our integrated systems to meet the evolving needs of the business. • Setting the remuneration for the Executive Committee (i.e. the layer of senior management immediately below Board level) and monitoring the success of the Restricted Share Plan • Ensuring that the Committee takes into account workforce remuneration and related policies when setting executive remuneration * The Directors consider that Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements is comparable to Adjusted operating profit previously reported. See Strategic Report for further details and a reconciliation between Adjusted operating profit of £39.2m and Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements of £36.2m. Jonathan Brooks Chair, Remuneration Committee 14 September 2021 102 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Directors’ remuneration policy The Remuneration Committee determines the Company’s policy on the remuneration of the Executive Directors and (from 1 June 2019) the Executive Committee (ExCom). The principles which underpin the Remuneration Policy for the Company are to: • Ensure Executive Directors’ rewards and incentives are directly aligned with the interests of the shareholders in order to reinforce the strategic priorities of the Group, optimise the performance of the Group and create long-term sustained growth in shareholder value, without encouragement to take undue risk • Provide the level of remuneration required to attract, retain and motivate Executive Directors and senior executives of an appropriate calibre • Ensure a proper balance of fixed and variable performance related components, linked to short and longer-term objectives and delivered in a mix of cash and shares • Reflect market competitiveness, taking account of the total value of all the benefit elements Our remuneration strategy has been designed to reflect the needs of a complex multinational organisation, which has grown both organically and by acquisition. Remuneration for the Executive Directors is structured so that the variable pay elements (annual bonus and long-term incentives) form a significant proportion of the overall package. This provides a strong link between the remuneration paid to Executive Directors and the performance of the Group, as well as providing a strong alignment of interest between the Executive Directors and shareholders. For the purposes of section 226D-(6)(b) of the Companies Act 2006, this Policy, if approved, will take effect from the date of the 2021 AGM on 4 November 2021. Current Policy table for Executive Directors Purpose and link to short and long-term strategic objectives Salary Operation (including framework to assess performance) Maximum opportunity Changes since last Directors’ Remuneration Policy To attract, retain and reward high calibre Executive Directors The Remuneration Committee reviews salaries for Executive Directors and also the Executive Committee (ExCom) annually unless responsibilities change. Details of current Executive Director salaries are set out on page 110. N/A Pay reviews take into account Group and personal performance. Salaries are set on appointment and benchmarked periodically against market data for companies operating in IT services, management consulting and relevant high tech sectors, which, although not directly comparable, provide an indicative range. In setting appropriate salary levels the Committee takes into account pay and employment conditions of colleagues elsewhere in the Group, alongside the impact of any increase to base salaries on the total remuneration package. Any changes are normally effective from 1 June each year. Salary increases are normally in line with those for other colleagues but also take account of other factors such as changes to responsibility, development and the complexity of the role. Benefits To attract, retain and reward high calibre Executive Directors Benefits in kind currently include the provision of a car or car allowance, payment of private fuel, car insurance, private medical insurance, life assurance and permanent health insurance. Executive Directors may be invited to participate in the Sharesave Scheme approved by HMRC or other benefits introduced for all colleagues. Market-competitive benefits. N/A SAYE Sharesave Scheme subject to HMRC-approved limits. Pension To provide a competitive benefit, which attracts high calibre executives and allows flexible retirement planning to suit individual needs Executive Directors are entitled to a Company pension contribution, which is paid into the Group defined contribution personal pension scheme. They can also opt to have the same level of contribution made in the form of a cash contribution. For both the current CEO and CFO, cash contributions in lieu of a pension are paid. Until 30 November 2021: up to 10% of base salary as a contribution into the Group scheme or base salary supplement of 10% of base salary. From 1 December 2021: capped at the level of the majority of the workforce (currently 4.5%). Alignment of Executive Directors’ pensions with the wider workforce from 1 December 2021. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 103 GovernanceGovernanceRemuneration Committee report continued Directors’ remuneration policy continued Current Policy table for Executive Directors continued Purpose and link to short and long-term strategic objectives Annual bonus To drive and reward sustainable business performance Operation (including framework to assess performance) Maximum opportunity 125% of base salary. A lower maximum of 100% of base salary will be operated in 2021/22. Based on a range of stretching targets measured over one year. This might include, but not exclusively, profit measures and other strategic objectives such as cash management, brand development, customer satisfaction and retention, business unit sales growth and colleague engagement. Performance below the minimum performance target results in no bonus. No more than 20% of the maximum opportunity is paid for achievement of the threshold performance targets. Payments rise from the threshold payment to 100% of the maximum opportunity for levels of performance between the threshold and maximum targets. The rate of the rise and the various payment targets are determined annually by the Committee. The Committee has discretion to reduce the formulaic bonus outcome if individual performance is determined to be unsatisfactory or if the individual is the subject of disciplinary action. At least 35% of any bonus payment is normally deferred into shares or nominal cost share options which vest after a two year period. Dividend equivalents are paid on vesting share options. Malus and clawback provisions are in place for both cash and deferred elements. Long Term Incentive Plan To drive long-term performance in line with Group strategy and incentivise through share ownership Awards have a performance period of at least three years and normally must be held for a further two years after vesting. The level of vesting is determined by measures appropriate to the strategic priorities of the business. At least half of any award will normally be subject to financial performance measures. Measures might include, but not exclusively, EPS, cash flow and relative TSR metrics. Award over shares with a face value at grant of 175% of salary p.a. with awards to the CFO normally capped at 150% of salary. The Remuneration Committee has the discretion to determine the number of measures to be used. Performance below the threshold target results in no vesting. For performance between the threshold target and maximum performance target, vesting starts at 15% and rises to 100% of the shares vesting. Should a change in control of the Group occur, crystallisation of any LTIP awards is within the discretion of the Remuneration Committee. Malus and clawback provisions are in place. Changes since last Directors’ Remuneration Policy With effect from 2022/23, the intention is to increase the opportunity to 125% of salary for both the CEO and CFO. For any awards made following the 2021 AGM, the intention is to increase the award to 175% for the CEO, and to 150% for the CFO. 104 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Purpose and link to short and long-term strategic objectives Operation (including framework to assess performance) Maximum opportunity Executive Director shareholding requirement To align the interests of Executive Directors with the interests of all of the Company’s shareholders The Executive Directors are expected to build and retain a shareholding in the Group at least equivalent to 200% of base salary. Executives will be required to retain all vested deferred bonus shares and LTIP shares released from the holding period until they have attained the minimum shareholding requirement and even then they may normally only sell when they have held vested LTIP shares for a minimum period of two years. N/A For the avoidance of doubt, Executive Directors are permitted to sell sufficient shares in order to meet any tax or withholding obligation arising from vesting shares. Retention of shares post-employment: Executives will be expected to retain the lower of their holding on cessation or 200% of salary for the first year following cessation, reducing to 100% of salary for the second year. Only shares granted from the conclusion of the 2021 AGM will count towards this requirement. Changes since last Directors’ Remuneration Policy For any awards made following the 2021 AGM, the post- employment shareholding policy will require 200% of base salary to be held in the first year post- employment, falling to 100% for the second year. Choice of performance measures and target setting For both the annual bonus and LTIPs, the objective of our Policy is to choose performance measures which help drive and reward the achievement of our strategy and which also provide alignment between executives and shareholders. The Committee reviews metrics annually to ensure they remain appropriate and reflect the future strategic direction of the Group. Targets for each performance measure are set by the Committee with reference to internal plans and external expectations. Performance is generally measured so that incentive payouts increase pro rata for levels of performance in between the threshold and maximum performance targets. With regard to the annual bonus, the Remuneration Committee believes that a simple and transparent scheme with sufficiently stretching targets and an element of bonus deferral prevents short-term decisions being made and ensures that the executives are focused on the delivery of sustainable business performance. For 2021/22, overall Adjusted operating profit and revenue growth by division have been selected as the principal financial measures, with non-financial measures selected that support the delivery of our key in-year strategic goals. With regard to the LTIP, the Committee believes in setting demanding objectives, which reward steady, progressive growth, in order to incentivise and encourage long-term growth and enhance shareholder value. EPS, cash conversion and relative TSR have been chosen for the awards to be granted in 2021/22 as these meet these criteria and are aligned with our strategy. Performance measures and targets are disclosed in the Annual Report on Remuneration. In cases where targets are commercially sensitive, for example annual profit targets for the annual bonus, they will normally be disclosed retrospectively in the year in which the bonus is paid. Differences in Remuneration Policy for colleagues and Executive Directors The principles behind the Remuneration Policy for Executive Directors are cascaded down through the Group and their aims are to attract and retain the best staff and to focus their remuneration on the delivery of long-term sustainable growth by using a mix of salary, benefits, bonus and longer-term incentives. As a result, no element of the Executive Director Remuneration Policy is operated exclusively for Executive Directors other than the post-employment shareholding policy: • The annual performance related pay scheme for Executive Directors is largely the same as that of the Executive Committee and other senior managers within the business and all are aligned with similar business objectives • Participation in the LTIP is extended to the Executive Committee and other senior managers where possible although restricted shares rather than performance shares are typically granted at levels below the Executive Committee • The pension scheme is operated for all permanent colleagues and from 1 December 2021 the Executive Directors will receive the same level of contribution as the majority of other colleagues The main difference between pay for Executive Directors and colleagues is that, for Executive Directors, the variable element of total remuneration is greater while the total remuneration opportunity is also higher to reflect the increased responsibility of the role. In addition, we have the ability to grant awards of restricted shares to Executive Committee members. This will enable us to be competitive in certain markets, most notably the USA, where such plans are very much part of any executive remuneration package. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 105 GovernanceGovernanceRemuneration Committee report continued Directors’ remuneration policy continued Non-Executive Director Policy table Purpose and link to short and long-term strategic objectives Fees Operation (including framework to assess performance) Maximum opportunity To attract, reward and retain experienced Non-Executive Directors Fees for the Non-Executive Directors are determined by the Board within the limits set by the Articles of Association and are based on information on fees paid in similar companies, taking into account the experience of the individuals and the relative time commitments involved. There will be separate disclosures of fees paid for chairing the Audit and Remuneration Committees and for acting as Senior Independent Director or for other additional responsibilities. Fees for the Non-Executive Directors are reviewed annually. Additional fees may be paid in certain circumstances such as taking on extra duties, or if exceptionally the time commitment is significantly increased. An expenses allowance is paid or alternatively any reasonable business related expenses (including tax thereon) can be reimbursed if determined to be a taxable benefit. Current fee levels are set out on page 110. The overall fee limit will be within the current £750,000 limit set out in the Company’s Articles of Association, approved on 25 September 2019, which is subject to increase on 25 September each year by the same percentage increase as the percentage increase in the General Index of Retail Prices for all items (or such other comparable index as may be substituted for it from time to time before such anniversary) in the 12 months immediately preceding such date. Changes since last Directors’ Remuneration Policy The overall fee limit is now £750,000. Extra fees may be paid in certain circumstances such as taking on extra duties. Approach to recruitment The principle applied in the recruitment of a new Executive Director is for the remuneration package to be set in accordance with the terms of the approved Remuneration Policy for existing Executive Directors in force at the time of appointment. Further details of this Policy for each element of remuneration are set out below. Pay element Approach Areas of flexibility Salary Set to reflect the executive’s skills and experience, the Company’s intended pay positioning and the market rate for the applicable role. Benefits and pension Benefits will be provided in line with those offered to other Executive Directors, taking account of local market practice, with relocation expenses or arrangements provided if necessary. The Committee will have the discretion to allow phased salary increases over a period of time for newly appointed Directors, even though this may involve increases in excess of the rate for the wider workforce and inflation in circumstances where starting salary was below median levels. Tax equalisation may also be considered if an Executive Director is adversely affected by taxation due to their employment with the Company. The Company may also pay legal fees and other costs incurred by the individual. These would all be disclosed. Pension would be set in line with the workforce level. The aggregate ongoing incentive opportunity offered to new recruits will be no higher than that offered under the annual bonus plan and the LTIP to the existing Executive Directors. Different performance measures and targets may be set initially for the annual bonus plan, taking into account the responsibilities of the individual and the point in the financial year at which they join. Incentive opportunity “Buyout” awards Sign-on bonuses are not generally offered by the Group but, at Board level, the Committee may offer additional cash and/or share-based “buyout” awards when it considers these to be in the best interests of the Company and, therefore, shareholders, including awards made under Listing Rule 9.4.2R. Any such “buyout” payments would be based solely on remuneration lost when leaving the former employer and would reflect the delivery mechanism such as cash, shares, options, time horizons and performance requirements attaching to that remuneration. In addition, any other ongoing remuneration obligations existing prior to appointment may continue, provided that they are put to shareholders for approval at the first AGM following their appointment. Transitional arrangements for internal appointments to the Board In the case of an internal appointment, any variable pay element awarded in respect of the prior role may be allowed to pay out according to its terms on grant, adjusted as relevant to take into account the appointment. 106 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Approach to service contracts and letters of appointment The Committee’s policy is to offer service contracts for Executive Directors with notice periods of between six and 12 months exercisable by either party. In addition, the Executive Directors are subject to a non-compete clause from the date of termination, where enforceable. All Non-Executive Directors’ appointments are terminable on at least three months’ notice on either side. The Executive Directors and Non-Executive Directors offer themselves for re-election at the AGM every year. Policy on payment for loss of office Payments on termination for Executive Directors are restricted to the value of salary and contractual benefits for the duration of the notice period. It is the policy of the Remuneration Committee to seek to mitigate termination payments and pay what is due and fair. There are no predetermined special provisions for Executive Directors with regard to compensation in the event of loss of office. The Company may also pay an amount considered to be reasonable by the Committee where loss of office is due to redundancy or in respect of fees for legal advice for the outgoing Director or to settle or compromise any legal claims. Assistance with outplacement may also be provided. Elements of variable remuneration would be treated as follows: Pay element Approach Areas of flexibility Annual bonus Determined on a case-by-case basis. When the Committee determines that the payment of an annual bonus is appropriate, the annual bonus payment is typically: • Prorated for the period of time served from the start of the financial year to the date of termination and not for any period in lieu of notice or garden leave • Subject to the normal bonus targets, tested at the end of the year, and would take into account performance over the notice period • Subject to deferral of 35% of the value The Committee has the discretion to pay cash bonus amounts or allow deferred bonus awards to vest on cessation or whether they lapse. If the Committee exercises this discretion, it can also determine if the vesting should be prorated to reflect time served since the beginning of the deferral date. The same discretionary principle would apply to the payment of dividend equivalents on any shares that have been deferred, but not yet vested. Long Term Incentive Plan Unvested awards will normally lapse upon cessation of employment. The Committee has discretion to allow awards to vest at the normal vesting date or earlier. If the Committee exercises this discretion, awards are normally prorated to reflect time served since the date of grant and based on the achievement of the performance criteria. The holding period detailed above will apply to such incentives. All-colleague share schemes The Executive Directors, where eligible for participation in all-colleague share schemes, participate on the same basis as for other colleagues. None. Illustration of remuneration scenarios The chart below details the hypothetical composition of each Executive Director’s remuneration package and how it could vary at different levels of performance under the new Remuneration Policy set out above. 2,500 2,000 1,500 0 0 0 £ 1,000 500 0 £2,188,000 £1,781,000 £856,000 14% 27% £502,000 46% 56% 26% 21% £1,354,000 £1,123,000 £576,000 12% 27% £353,000 41% 51% 27% 23% 100% 59% 28% 23% 100% 61% 32% 26% Minimum Target Maximum Maximum + 50% share price growth Minimum Target Maximum Maximum + 50% share price growth Chief Executive Officer Chief Financial Officer Long-term incentives Annual bonus Fixed pay NCC Group plc — Annual report and accounts for the year ended 31 May 2021 107 GovernanceGovernanceRemuneration Committee report continued Directors’ remuneration policy continued Illustration of remuneration scenarios continued Note that the charts are indicative, as actual amounts may depend on share price. Assumptions made for each scenario are as follows: • Minimum. Fixed remuneration only: salary, benefits and pension. Salary based on 2021/22 salary and benefits based on 2020/21 disclosed benefit amounts • Target. Fixed remuneration plus “target” annual bonus opportunity of 50% of salary for both the Chief Executive Officer and Chief Financial Officer, plus 15% vesting of the maximum award under the Long Term Incentive Plan. NCC does not use the concept of a “target” bonus; however, in order to be fully compliant with the regulations an assumption of 50% of the maximum for 2021/22 has been used • Maximum. Fixed remuneration plus maximum annual bonus opportunity equivalent to 100% of salary for both the Chief Executive Officer and Chief Financial Officer for 2021/22, as well as 100% vesting of the maximum award under the Long Term Incentive Plan, being 175% of salary for the CEO and 150% of salary for the CFO. Note that from 2022/23 it is intended that the maximum annual bonus will increase from 100% of salary to 125% of salary • Effect of a 50% increase in share price. Same assumptions as for the maximum scenario, but with the additional assumption that the value of LTIP awards increases by 50% as a result of share price appreciation over the performance period Statement of consideration of employment conditions elsewhere in the Group The Remuneration Committee does not consult directly with colleagues when determining the Remuneration Policy for Executive Directors. However, as stated above, the annual bonus and LTIP are operated for other colleagues to ensure alignment of objectives across the Group and the terms of the pension scheme (save for the contribution entitlements) are the same for all permanent colleagues. In addition, the Committee compares information on general pay levels and policies across the Group when setting Executive Director pay. Jennifer Duvalier undertakes regular colleague engagement sessions where colleagues are able to ask about Executive Director pay. During the year no questions or concerns on Executive pay were raised to Jennifer (please see page 80 for further information). How shareholder views are taken into account The Remuneration Committee considers shareholder feedback received on the Directors’ Remuneration Report each year and guidance from shareholder representative bodies more generally. Shareholders’ views are key inputs when shaping remuneration policy. When any material changes are proposed to the Remuneration Policy, the Remuneration Committee Chair will inform major shareholders in advance and will generally offer a meeting to discuss these. Key areas of discretion in the Remuneration Policy The Committee operates the Group’s variable incentive plans according to their respective rules and in accordance with HMRC rules where relevant. To ensure the efficient administration of these plans, the Committee will apply certain operational discretions. These discretions are implicit in the Policy stated above, but we have listed them for clarity. These include, but are not limited to, the following: • Selecting the participants in the incentive plans on an annual basis • Determining the timing of grants of awards and/or payments • Determining the quantum of awards and/or payments (within the limits set out in the Policy table) • Reviewing performance against annual bonus and LTIP performance metrics • Determining the extent of payout or vesting based on the assessment of performance • Making the appropriate adjustments required in certain circumstances, for instance for changes in capital structure • Determining “good leaver” status for incentive plan purposes and applying the appropriate treatment • Undertaking the annual review of weighting of performance measures and setting targets for the incentive plans, where applicable, from year to year • Discretion to override formulaic outcomes of the incentive schemes if an event occurs which results in the annual bonus plan or LTIP performance conditions and/or targets being deemed no longer appropriate (e.g. material acquisition or divestment); the Committee will have the ability to adjust appropriately the measures and/or targets and alter weightings, provided that the revised conditions are not materially less challenging than the original conditions • Discretion to override formulaic vesting outcomes if they are judged by the Committee not to be an accurate reflection of Company performance Legacy arrangements For the avoidance of doubt, in approving the Remuneration Policy, authority is given to the Company to honour any commitments entered into with current or former Directors before the current legislation on remuneration policies came into force or before an individual became a Director, such as the payment of outstanding incentive awards, even where it is not consistent with the policy prevailing at the time such commitment is fulfilled. Details of any payments to former Directors will be set out in the Annual Report on Remuneration as they arise. External directorships for Executive Directors Executive Directors may accept one external non-executive directorship with the prior agreement of the Board, provided it does not conflict with the Group’s interests and the time commitment does not impact upon the Executive Director’s ability to perform their primary duty. The Executive Directors may retain the fee from external directorships. 108 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Annual report on remuneration This part of the report has been prepared in accordance with Part 3 of The Large and Medium-sized Companies and Groups (Accounts and Reports) (Amendment) Regulations 2013 as amended and 9.8.8R of the Listing Rules. The following report will be subject to an advisory shareholder vote at the 2021 AGM, which is scheduled to be held on 4 November 2021. The information on pages 109 to 118 has been audited where indicated. How will the Remuneration Policy be implemented in the year ending 31 May 2022? Executive Directors’ base salaries The Committee has decided to award a salary increase to the Chief Executive Officer of 3%, which is in line with the average increase for the workforce of 3.1%. As set out in the Annual Statement, the base salary of the Chief Financial Officer is significantly below the market level for comparable roles and a base salary increase of approximately 4.9% above the level of the workforce with effect from 1 June 2021. The table below details the Executive Directors’ salaries as at 31 May 2021 and salaries which took effect from 1 June 2021: Chief Executive Officer Chief Financial Officer Base salary at 31 May 2021 £000 Base salary at 1 June 2021 £000 451 285 465 308 % change 3% 8% Pension and benefits There will be no changes to benefits provision. Effective 1 December 2021, and conditional on the approval of the Directors’ Remuneration Policy at the 2021 AGM, the CEO’s and CFO’s pension provision will reduce from 5% of base salary and 10% of base salary, respectively, to the level of the wider workforce, which is currently 4.5%. These contributions are cash payments in lieu of formal pension contributions. Annual bonus The annual bonus maximum for the Chief Executive Officer and the Chief Financial Officer in 2021/22 will be 100% of salary with 75% based on the achievement of certain Adjusted operating profit and revenue targets and 25% based on the achievement of strategic targets as outlined on page 102. A financial underpin will apply to the revenue and non-financial bonus targets. To the extent they are no longer commercially sensitive, these targets will be disclosed in next year’s report. In addition, to ensure that this bonus opportunity results in shareholder alignment and provides greater retention value, 35% of any bonus payment will be deferred into nominal cost share options for two years. The bonus, nominal cost share options and associated dividend equivalents are also subject to malus and clawback provisions. Long Term Incentive Plan (LTIP) Subject to approval of the new Remuneration Policy it is intended that awards with a maximum value of 175% and 150% of base salary to the CEO and CFO respectively will be made under the LTIP shortly following the 2021 AGM. These will be subject to a two year post-vesting holding period for the Executive Directors. As well as the holding period, the executives have to achieve a shareholding requirement of 200% of salary (post shares sold to cover any tax) before they can sell any shares that vest, with these awards also counting towards the post-employment shareholding requirement. The awards are also subject to malus and clawback provisions. The vesting of these LTIP awards will be based on earnings per share (60%), a cash flow metric (30%) and a relative total shareholder return metric (10%). 15% of each element will vest at the threshold performance level, rising to 100% vesting at maximum. The proposed targets are as follows: Metric Earnings per share growth Average cash conversion Relative TSR vs FTSE 250 (excluding investment trusts) Weight 60% 30% 10% Threshold (15% vests) Maximum (100% vests) 9% p.a. 70% Median 22.5% or higher 80% or higher Upper quartile or above For performance between threshold and maximum, awards vest on a straight-line basis. The Committee believes that these three measures are transparent, easy to understand, easy to track and communicate, cost effective to measure and fundamentally aligned to the Group’s strategic goals. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 109 GovernanceGovernanceRemuneration Committee report continued Annual report on remuneration continued Non-Executive Directors’ remuneration In line with the current Policy, Non-Executive Director fees are reviewed annually. Annualised fees (inclusive of travel allowance of £8,200 for the Chair and £4,750 for other Non-Executive Directors which was waived in 2020/21) Chris Stone Chris Batterham Jonathan Brooks Mike Ettling Jennifer Duvalier As at 1 June 2021 £000 158 75 65 55 60 As at 1 June 2020 £000 147 64 58 51 51 How has the Remuneration Policy been implemented in the year ended 31 May 2021? This section sets out how the Remuneration Policy was implemented in 2020/21. The key implementation decisions during the year related to: • Review of salary increases for Executive Directors • The determination of annual bonus outcomes for the 2020/21 performance period • The performance targets and value of awards granted under the LTIP, which will vest in 2023 Further detail on these decisions, together with other information on payments made to Directors, is set out in the following sections. Single total figure of remuneration (audited) The detailed emoluments received by the Executive and Non-Executive Directors for the year ended 31 May 2021 are below: Director Chris Stone Adam Palser Tim Kowalski 6 Chris Batterham Jonathan Brooks Jennifer Duvalier 7 Mike Ettling Total Salary/ Non-Executive Director fees 1 £000 138 145 450 447 284 282 59 63 53 57 51 50 46 50 Benefits 2 £000 Pension benefits 3 £000 Total fixed pay £000 Annual bonus 4 £000 Long-term incentive 5 £000 – – 16 16 31 17 – – – – – – – – – – 22 22 28 28 – – – – – – – – 138 145 488 485 343 327 59 63 53 57 51 50 46 50 – – 414 103 247 56 – – – – – – – – – – 218 273 137 – – – – – – – – – Total variable pay £000 – – 632 376 384 56 – – – – – – – – Total £000 138 145 1,120 861 727 383 59 63 53 57 51 50 46 50 1,081 1,094 47 33 50 50 1,178 1,177 661 159 355 273 1,016 313 2,194 1,609 Year ended 31 May 2021 31 May 2020 31 May 2021 31 May 2020 31 May 2021 31 May 2020 31 May 2021 31 May 2020 31 May 2021 31 May 2020 31 May 2021 31 May 2020 31 May 2021 31 May 2020 31 May 2021 31 May 2020 1 2 3 4 5 The Chair and Non-Executive Directors each receive an allowance paid as part of their base fees of £8,200 and £4,750 respectively, to cover all travel and expenses related to their roles on the Board. In light of Covid-19 and the fact that Board meetings were being held virtually, these allowances were not paid between 1 June 2020 and 31 May 2021. Taxable benefits include the provision to every Executive Director of a car or car allowance, payment of private fuel, car insurance, private medical insurance, life assurance and permanent health insurance. In 2020/21, Tim Kowalski switched from receiving a car allowance to a leased vehicle at no additional cost to the Group. The P11D value of the leased vehicle is higher than the monthly cash value of the car allowance which he forfeited. Pension benefits include employer contributions to the Group pension scheme and payments in lieu of pension contributions. The Company provided pension payments in lieu of pension contributions for two Executive Directors during the year ended 31 May 2021. Annual bonus payments for performance in the relevant financial year; 35% of this bonus is deferred into nominal cost share options for two years. Dividend equivalents accrue on these shares. Long-term incentive awards vesting under the LTIP. 78,914 shares vested to Adam Palser and 49,773 shares vested to Tim Kowalski with respect to the LTIP granted in 2018 which had a performance period ending on 31 May 2021. These have been valued using a share price of £2.76 which is the three month average share price over March, April and May 2021. These shares were awarded based on a share price of £2.21 on the day before the date of grant. As a result, the change in share price since the date of grant has resulted in an increase in value of £43,402.70 and £27,375.15 respectively. With regard to the LTIP awards with a performance period ending on 31 May 2020, 93,533 shares vested to Adam Palser which have been valued using the share price at the date of vesting of £2.92. 6 Tim Kowalski was appointed as Chief Financial Officer on 23 July 2018. 7 Jennifer Duvalier’s fee was increased by £5,000 with effect from 1 June 2020 to reflect her additional responsibilities for engaging with colleagues on behalf of the Board. 110 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Additional information in respect of the single total figure of remuneration Annual bonus 2020/21 annual bonus (audited) For the year ended 31 May 2021, the maximum potential bonus opportunity for Adam Palser was 100% of salary. For Tim Kowalski, the maximum potential bonus opportunity was also 100% of salary. For the year ended 31 May 2021, bonuses of 92% and 87% of base salary respectively were payable. The actual bonus awarded to Adam Palser was £413,876 and to Tim Kowalski was £247,071 based on the achievement of the performance conditions set out below. 35% of each payment will be deferred into nominal cost share options for two years, with the remaining 65% paid in cash. The performance measures and targets are set out below. Financial targets – up to 60% of the bonus 30 November 2020 Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements * 31 May 2021 Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements * Strategic targets Performance targets Threshold Maximum Actual Threshold Maximum Actual £11.5m £12.5m £17.0m £16.0m £19.0m £19.2m Weighting (% of salary) Weighting (% of salary) Payout (% of salary) Weighting (% of salary) Weighting (% of salary) Payout (% of salary) The strategic targets were set individually for the Executive Directors based on key strategic objectives for the year in their area of responsibility – see below Weighting (% of salary) Payout (% of salary) Adam Palser Tim Kowalski 6% 30% 30% 6% 30% 30% 40% 32% 6% 30% 30% 6% 30% 30% 40% 27% Payout (% of salary) 92% 87% Total bonus £413,876 £247,071 Amount paid in cash £269,019 £160,596 Amount deferred in shares £144,857 £86,475 * The Directors consider that Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements is comparable to Adjusted operating profit previously reported. See Strategic Report for further details and a reconciliation between Adjusted operating profit of £39.2m and Adjusted operating profit less a proforma amortisation charge in respect of certain cloud-based software arrangements of £36.2m. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 111 GovernanceGovernanceRemuneration Committee report continued Annual report on remuneration continued Additional information in respect of the single total figure of remuneration continued Annual bonus continued Strategic targets – up to 40% of the bonus The table below highlights the key strategic targets and achievements for each Executive Director. Bonus target ranges have been disclosed to the extent possible, but the achievement of some areas is determined by the Committee based on its judgement of performance. Maximum % of bonus Target and performance conditions 20% Broaden the portfolio (20%) EaaS orders (5%) – Target range of £1.5m to £2.0m. Exceeded max target by +10%. Remediation revenue (5%) – Target range of £1.0m to £1.5m. Exceeded max target by +40%. MDR revenue growth (5%) – Target range of 15% to 20% growth. Positive double-digit growth was achieved but below the target range. Hyperscaler (2%) – Target to certify 43 new consultants and deploy them successfully. Target was exceeded with more than 43 consultants certified and deployment resulting in launch of Sentinel offering, sales growth, and strong pipeline. Data (3%) – Target of progress towards (1) being able to benchmark clients’ cyber maturity and underpin FY22 revenues and (2) improved data analytics and machine learning to satisfy our more demanding MDR clients and underpin future revenue growth. Both objectives were met and exceeded as models have been developed and even deployed to meet both objectives. Sustainability (10%) Diversity (3%) – Evidence of a comprehensive programme to nurture and promote diversity and inclusion including: effective steering committees, improved hiring practices, rollout of unconscious bias training and awareness raising/engagement programme. Target achieved and exceeded as all objectives achieved and demonstrating success. Diversity (2%) – Evidence of greater diversity and inclusion in the workforce, especially in leadership roles. Target achieved and exceeded by improving hiring practices which has resulted in the number of men employed for every woman reducing by over 50% at senior levels and by 11% overall. Reduce attrition (3%) – Target range for a reduction of 1% to 2%. Performance below threshold. Clear measurement of colleague and customer engagement (2%) – achieved. Key hires (5%) – Progress against recruitment/upgrade plan measured through: assessment of number and quality of hires, team progress against development plans, and how these changes have improved reporting deliverables. Partial achievement and progress made. Improvement and efficiencies (10%) Overheads as % revenue (3%) – Target to reduce overheads/revenue vs. prior year – achieved and exceeded. Creation of an EU division (2%) – Evidence of the successful creation of a single (Continental) European division. Achieved – new MD in place and management team confirmed. Global resourcing (3%) – 3% awarded if there is >20% increase in cross-border delivery (demonstrating our global way of operating). Achieved and exceed with an increase of over 100%. Creation of “Global Professional Services” and “Global Managed Services” business to underpin future growth and efficiency (2%). Set-up of global product lines with strategic business plans in place and initial progression tracked against these. Achieved. Finance function (7%) – Evidence of team improvements and efficiencies including: systems installation to time/quality/risk targets, assessment, design, and delivery of new reporting requirements for Europe and GPS/GMS, improvement in timings/accuracy/quality of month end and end of year reporting and quality of analyst presentations. Evidence of progress in all areas and improvement in quality of analyst presentations, but too early to judge the success of all actions taken. As a result, a partial outcome was awarded. 5% 5% 5% 2% 3% 3% 2% 3% (CEO) 2% (CEO) 5% (CFO) 3% 2% (CEO) 3% (CEO) 2% (CEO) 7% (CFO) Total 31 May 2021 Adam Palser Tim Kowalski 5% 5% 0% 2% 5% 5% 0% 2% 3% 3% 15% 15% 3% 3% 2% 2% 0% 2% – – – 2% 7% 7% 3% 2% 3% 2% 3% – – – – 2% 10% 32% 5% 27% 112 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Long Term Incentive Plan vesting The LTIP awards made in August 2018 vested in May 2021. Adam Palser and Tim Kowalski were beneficiaries of these and achieved a vesting of 40% of the award of 197,285 and 124,434 shares respectively, being 78,914 and 49,773 shares respectively: Executive Number of LTIP awards 1 Basis Performance condition Adam Palser 197,285 Tim Kowalski 124,434 100% of base salary Vesting determined by: • Growth in Adjusted EPS 3 over the performance period • Average cash conversion ratio ³ over the performance period • TSR over the performance period vs FTSE 250 comparator group The performance conditions for these awards are set out below: Performance period 1 June 2018 to 31 May 2021 Proportion Component Metric Threshold Maximum vesting Actual performance Actual % vested 60% 30% Adjusted EPS 3 Average growth over a three year period Cash conversion 3 Average cash conversion ratio ³ over three years 9% 20% 8.2% 0% 70% 80% 109.3% 30% Vesting basis Straight line between threshold and maximum Straight line between threshold and target, then target and maximum 10% TSR TSR over three years vs FTSE 250 comparator group (excluding investment trusts) Median Upper quartile Above upper quartile 10% Straight line between threshold and maximum Long-term incentives granted during the year (audited) During the financial year, the Executive Directors were granted awards subject to the performance conditions set out below. The awards were as follows: Executive Number of LTIP awards 1 Adam Palser 151,876 Basis Face value 2 Performance condition 100% of base salary £447,000 Vesting determined by: • Growth in Adjusted EPS ³ over the performance period • Average cash conversion ratio ³ over the performance period • TSR over the performance period vs FTSE 250 comparator group Tim Kowalski 95,875 100% of base salary £282,000 As above The performance conditions for these awards are set out below: Proportion Component Metric Threshold Threshold vesting 9% 20% Target N/A Target vesting N/A Maximum Maximum vesting 20% 100% 70% 20% 75% 50% 80% 100% Performance period 1 June 2020 to 31 May 2023 1 June 2020 to 31 May 2023 Vesting basis Straight line between threshold and maximum Straight line between threshold and target, then target and maximum Median 20% N/A N/A Upper quartile 100% Straight line between threshold and maximum 60% 30% Adjusted EPS 3 Cash conversion ³ Average growth over a three year period Average cash conversion ratio ³ over three years 10% TSR TSR over three years vs FTSE 250 comparator group (excluding investment trusts) 1 LTIP awards are structured as nominal cost options. 2 Based on a share price of £2.94, which was the closing mid-market price of the Company’s shares on the day before the date of grant. 3 See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items. Further information is also contained within the Chief Financial Officer’s Review and the Glossary of terms on pages 187 and 188. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 113 GovernanceGovernanceRemuneration Committee report continued Annual report on remuneration continued SAYE options granted in the year The Group operates an HMRC-approved SAYE scheme. All eligible colleagues, including Executive Directors, may be invited to participate on similar terms for a fixed period of three years. During the year Adam Palser and Tim Kowalski did not join any new SAYE schemes. Neither Executive Director participated in the 2020 or 2021 SAYE schemes as both contribute the maximum £500 per month to the 2018 SAYE scheme. Directors’ interests in shares (audited) The tables below set out details of the Executive Directors’ outstanding share awards, which will vest in future years subject to performance conditions and/or continued service. Summary of maximum LTIP awards outstanding Adam Palser Tim Kowalski Includes only unvested and unexercised LTIP options. 1 2 £2.92 was the sale price. Total LTIP options held at 31 May 2020 1 Granted during the period Exercised during the period Share price on date of exercise Lapsed during the period Total LTIP options held at 31 May 2021 1 536,156 151,876 93,533 £2.92 2 (118,371) 476,128 279,310 95,875 – – (74,655) 300,530 All awards granted under the LTIP are subject to continued employment and the satisfaction of the performance conditions as set out above. The awards were all nominal cost options. Share ownership (audited) The beneficial and non-beneficial interests of the current Directors in the share capital of NCC Group plc at 31 May 2021 are set out below: Beneficial interests in ordinary shares 1 Maximum share awards subject to performance conditions 2 Share options 3 Deferred Bonus Plan 4 Vested but unexercised nil-cost options Total 31 May 2021 31 May 2020 31 May 2021 31 May 2020 31 May 2021 31 May 2020 31 May 2021 31 May 2020 31 May 2021 31 May 2020 31 May 2021 31 May 2020 Chris Stone Adam Palser Tim Kowalski 162,843 124,382 – – – – – – – – 162,843 124,382 94,502 23,779 397,214 442,623 10,273 10,273 53,458 52,225 78,914 93,533 634,361 622,433 48,964 23,614 250,751 279,310 10,273 10,273 27,173 20,462 49,773 Chris Batterham 55,000 50,000 Jonathan Brooks Jennifer Duvalier Mike Ettling 50,000 50,000 19,115 9,500 50,000 50,000 – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – 386,934 333,659 55,000 50,000 50,000 50,000 19,115 9,500 50,000 50,000 1 This information includes holdings of any connected persons. 2 These awards represent the outstanding LTIP interests, included in the table above, which are due to vest in either July/August 2022 or July/August 2023. 3 Representative SAYE scheme interests, which are due to vest in October 2021. 4 Nominal cost share options granted under the 2018–20, 2019–21 and 2020–22 Deferred Bonus Plans on 23 August 2018, 4 September 2019 and 20 May 2021, subject to a service condition, tax and National Insurance. Shareholding requirements The Executive Directors are expected to build and retain a shareholding in the Group equivalent to at least 200% of base salary. Executives will normally be required to retain all vested deferred bonus shares and LTIP shares released from the holding period, until they have attained the minimum shareholding requirement and, even then, only when they have held vested LTIP shares for a minimum period of two years. Executive Directors will also be required to retain all shares vesting from SAYE schemes. For the avoidance of doubt, Executive Directors are permitted to sell sufficient shares in order to meet any tax obligation arising from vesting shares. 114 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 The percentages within this table have been calculated using a three month average share price (1 March 2021 to 31 May 2021) of £2.76 and include Adam Palser’s and Tim Kowalski’s vested 2018–2021 LTIP of 78,914 and 49,773 shares respectively on a net of tax and National Insurance basis, and all unvested deferred bonus plans on a net of tax and National Insurance basis. Adam Palser Tim Kowalski Appointment terms for new Directors No new Directors were appointed within the year. Shareholding as at 31 May 2021 (% of salary) Shareholding requirements (% of salary) Requirement met 200% 200% 101% 87% No No Relative importance of the spend on pay The following table sets out the percentage change in distributions to shareholders and colleague remuneration costs. Colleague remuneration costs 1 Dividends 2 31 May 2021 £m 174.3 13.0 31 May 2020 £m 170.1 12.9 % change 2.5% 0.8% 1 Based on the figure shown in Note 7 to the Consolidated Financial Statements. 2 Based on the total cash returned to shareholders in the year ended 31 May 2021 through dividends, as shown in Note 10 to the Consolidated Financial Statements (excluding the proposed 2021 final dividend). Percentage increase in the remuneration of the Directors The table below shows the movement in the salary or fees, benefits and annual bonus for each Director between the current and previous financial year compared to the equivalent changes for all colleagues of the Company. The comparator group for salaries and benefits is all colleagues in the UK – there were no benefit policy changes in this time. The comparator group for the bonus is those in the senior management population who also have an annual scheme and excludes those on commission and incentive plans. Director Chris Stone 1 Adam Palser 2 Tim Kowalski 2 Chris Batterham 1 Jonathan Brooks 1 Jennifer Duvalier 1 Mike Ettling 1 All colleagues % increase in salary % increase in benefits % increase in annual bonus – 1% 1% – – – – 3.1% – – – – – – – – – 303% 341% – – – – 173% 1 Pay decreased for the Chair and Non-Executives during the year as they were not paid the travel allowance. 2 These increases represent the change in bonus payment from 2019/20 to 2020/21. For Adam Palser, this was an increase from £103,000 to £414,000 (i.e. from 23% of maximum to 92% of maximum). For Tim Kowalski, this was an increase from £56,000 to £247,000 (i.e. from 20% of maximum to 87% of maximum). NCC Group plc — Annual report and accounts for the year ended 31 May 2021 115 GovernanceGovernanceRemuneration Committee report continued Annual report on remuneration continued Chief Executive pay compared to pay of UK colleagues The following table shows the ratio between the single total figure of remuneration (STFR) of the Chief Executive for 2020/21 and the lower quartile, median and upper quartile pay of our UK colleagues. The salary and total pay and benefits for the lower quartile, median and upper quartile colleagues are also shown. Total pay ratio Financial year 2019/20 2020/21 Salary (£000) Total pay and benefits (£000) Method 25th percentile pay ratio 50th percentile pay ratio 75th percentile pay ratio Option B Option B 18:1 27:1 12:1 18:1 8:1 11:1 CEO 25th percentile 50th percentile 75th percentile 450 1,120 38 41 55 61 84 99 CEO pay ratio Option B was chosen to calculate the CEO pay ratio. This option uses the most recent gender pay gap information to determine the relevant colleague at the 25th, 50th and 75th percentile. We have omitted joiners and leavers from the data to ensure that the data is on a like-for- like basis. This option was chosen in preference to the other possibilities as it uses the most accurate and comprehensive data currently available. It refers to gender pay data as at April 2020. The CEO pay ratio has increased compared to the prior year. This increase is not attributable to a change in remuneration for the CEO, pay and benefits for colleagues as a whole, or a change in the composition of our workforce. Instead, the change in CEO pay ratio is attributable to the increase in share price over the financial year and the strong financial performance which increased payments from our variable incentive plans. As CEO pay places greater weight on “at risk” variable remuneration, Company performance has a greater impact on CEO pay than on pay for the median colleague, which leads to greater year-on-year variations. The pay ratio is consistent with the pay, reward and progression policies currently in place at NCC. A common pay structure operates throughout our organisation in the United Kingdom with a greater focus on performance related pay for more senior levels. Performance graph and table The following graph shows the total shareholder return, with dividends reinvested, from 31 May 2011 against the corresponding changes in a hypothetical holding in shares in both the FTSE All Share and FTSE 250 Indices. The FTSE All Share and FTSE 250 Indices represent broad equity indices. The Company is a constituent member of the FTSE All Share Index and the Committee has adopted the FTSE 250 Index for part of its LTIP performance measure. Both indices give a market capitalisation-based perspective. During the year, the Company’s share price varied between £1.492 and £3.075 and ended the financial year at £2.96. Ten year historical TSR performance is the growth in the value of a hypothetical £100 holding over ten years. It has been calculated for NCC Group plc, and the FTSE All Share and FTSE 250 Indices (excluding investment trusts) based on spot values. ) £ ( e u a V l 500 400 300 200 100 0 £136 £122 £100 £337 £205 £245 £205 £209 £257 £198 £390 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 NCC Group FTSE All Share FTSE 250 (excluding investment trusts) The share price was £1.586 on 1 June 2020 and £2.96 on 31 May 2021. Year ended 31 May 116 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 The table below shows the total remuneration for the Chief Executive over the same ten year period, including share awards valued at the date they vested. Year ended 1, 2, 3 31 May 2021 31 May 2020 31 May 2019 31 May 2018 1 31 May 2018 2 31 May 2017 31 May 2016 31 May 2015 31 May 2014 31 May 2013 31 May 2012 31 May 2011 Total remuneration £000 1,120 861 679 292 1 257 2 610 1,091 993 1,089 1,118 1,074 1,222 Annual bonus % of maximum 4 Long-term incentives % of max imum 5 92 23 48 32.5 32.5 – 70 73 73 – 6 85 67 40 52 – – – – 20 15 50 63 70 54 1 Adam Palser was appointed on 1 December 2017. The total remuneration figure above is in respect of the period from 1 December 2017 to 31 May 2018. 2 During the year ended 31 May 2018, Brian Tenner acted as Interim Chief Executive Officer for the period 1 June 2017 to 30 November 2017. The total remuneration figure above is the total remuneration received in relation to that six month period. 3 Relates to the former CEO in the period above between 1 June 2010 and 31 May 2017. 4 Note that this shows the annual bonus payments as a percentage of the maximum opportunity. 5 This shows the LTIP vesting level as a percentage of the maximum opportunity. 6 In 2012/13 the former CEO waived his right to a bonus, which would have been equal to 32% of salary. This was equivalent to 50% of the maximum bonus opportunity. Membership and attendance The Remuneration Committee membership consists solely of Non-Executive Directors and comprises Jonathan Brooks as Chair, Chris Batterham and Jennifer Duvalier. The Company Chair, Chief Executive Officer, Chief Financial Officer, Chief People Officer and Company Secretary attend the Remuneration Committee by invitation of the Chair of the Committee from time to time and assist the Committee with its considerations. No Director is involved in setting their personal remuneration. The attendance of individual Committee members at Remuneration Committee meetings is shown in the table below: Attendee Jonathan Brooks 1 Chris Batterham Jennifer Duvalier Meetings attended 1 Jonathan Brooks missed the July 2020 Committee meeting as he was taken ill on the day of the Committee meeting. Jennifer Duvalier chaired the July 2020 meeting. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 117 GovernanceGovernance Remuneration Committee report continued Annual report on remuneration continued Adviser to the Committee During the year, the Committee received advice on senior executive remuneration from Alvarez and Marsal (A&M) and was comfortable that the advice was objective and independent. A&M is a member of the Remuneration Consultants Group and is a signatory to its Code of Conduct. The total fee charged in 2020/21 for providing advice in relation to executive remuneration was £59,100. A&M did not provide any other services to the Company during the year. The Committee reviews the performance and independence of its adviser on an annual basis. Service contracts and letters of appointment The service contracts and letters of appointment of the current Directors include the following terms: Date of contract Notice period Executive Adam Palser Tim Kowalski Non-Executive Chris Stone Chris Batterham Jonathan Brooks Jennifer Duvalier Mike Ettling 29 November 2017 16 July 2018 31 March 2017 9 April 2015 13 March 2017 25 April 2018 21 September 2017 12 months 6 months 3 months 3 months 3 months 3 months 3 months Dilution The LTIP has a dilution limit, for new and treasury shares, of 10% of the issued ordinary share capital of the Company in any ten year period for any share option scheme operated by the Company. As at 31 May 2021 the Company had utilised 15,956,413 (31 May 2020: 15,250,101) ordinary shares through LTIP, DABS, SAYE, CSOP, ISO, RSP and ESPP awards counting towards the 10% limit which represents 5.17% (2020: 5.47%) of the issued ordinary share capital of the Company. To clarify, this figure of 5.17% includes both discretionary and all-colleague share schemes. Statement of shareholder voting The following votes were received from the shareholders in respect of the Directors’ Remuneration Report and in respect of the Remuneration Policy: Remuneration Report (2020 AGM) Remuneration Policy (2020 AGM) For 1 Against Total votes cast (for and against excluding withheld votes) Votes withheld 2 Total number of votes 102,161,835 96,087,573 198,249,408 12,904,409 Total votes cast (including withheld votes) 211,153,817 % of votes cast 51.53 48.47 Total number of votes 163,090,941 37,158,392 200,249,333 10,904,484 211,153,817 Includes Chair’s discretionary votes. 1 2 A vote withheld is not a vote in law and is not counted in the calculation of the proportion of votes cast “for” and “against” a resolution. Approved by the Board and signed on its behalf: % of votes cast 81.44 18.56 Jonathan Brooks Chair, Remuneration Committee 14 September 2021 118 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Directors’ report The Directors present their report The Directors present their report and the Group and Company Financial Statements of NCC Group plc (the ‘Company’) and its subsidiaries (together the ‘Group’) for the financial year ended 31 May 2021. Principal activities The Company is a public limited company incorporated in England, registered number 4627044, with its registered office at XYZ Building, 2 Hardman Boulevard, Spinningfields M3 3AQ. The principal activity of the Group is the provision of independent advice and services to customers through the provision of Software Resilience and cyber assurance services. The principal activity of the Company is that of a holding company. Going concern The Directors have acknowledged guidance published in relation to going concern assessments. The Group’s business activities, together with the factors likely to affect its future development, performance and position, are set out in the Business Review and Financial Review. The Group’s financial position, cash and borrowing facilities are also described within these sections. The Financial Statements have been prepared on a going concern basis which the Directors consider to be appropriate for the following reasons. The Directors have prepared cash flow and covenant compliance forecasts for the 12 month period ending September 2022 which indicate that, taking account of severe but plausible downsides and the anticipated impact of Covid-19 on the operations of the Group and its financial resources, the Group and Company will have sufficient funds to meet their liabilities as they fall due for that period. The Group is financed primarily by a £100m committed revolving credit facility which matures in June 2024. The Group is required to comply with financial covenants for leverage (net debt to Adjusted EBITDA 1) and interest cover (Adjusted EBITDA 1 to interest charge) which are tested bi-annually at 31 May and 30 November each year. As at 31 May 2021, the Group had drawn down £33.8m for working capital requirements. Subsequent to the year end and shareholder approval on 1 June, the Group acquired on 7 June the IPM business for $220m; the US acquisition was funded through an equity placing in May of £70.2m (net proceeds) combined with a new three year $70m term loan, existing cash balances and our existing revolving credit facility. The impact of the acquisition on the Group’s financial performance, covenants and business model has therefore been considered within this going concern assessment. As at 2 June 2021, following the acquisition of the IPM business, the Group had drawn down £75.5m of its revolving credit facility and was due to incur further transaction costs of £6.4m. As at 31 August 2021, cash, net debt (excluding lease liabilities) 1 and headroom amounted to £43.6m, £74.7m and £80.5m respectively. 1 See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items. Further information is also contained within the Chief Financial Officer’s Review and the Glossary of terms on pages 187 and 188. Although the Group has demonstrated resilience to the challenging environment resulting from Covid-19, the Directors acknowledge that the financial performance of the Group has been adversely impacted to a certain degree since the commencement of the pandemic, and for this reason the base case forecast for 2021 reflects this assessment. The continuing macro-economic risks and potential changes in government policies (on the severity of enforced lockdowns worldwide) could have a continued effect on the Group’s performance. However, trading throughout the pandemic has demonstrated resilience. The Directors have prepared a number of severe but plausible scenarios as follows: 1. 2. The performance of FY22 continues to be similar to that of 2021, including the impact on regional and international operations of the Group and a potential reduction in growth. An additional impact of Covid-19 during a two month period from January to February 2022 which coincides with a similar economic pandemic pattern as 2021. 3. Potential impact of customers‘ inability to pay during a specified period. 4. 5. Failure of execution of the strategy, loss of key customers and a number of acquisition related risks crystallising (for example increased customer churn, integration and cash collection issues). Software Resilience performance does not return to growth and the Assurance business experiences similar impact of Covid-19 on its performance as 2021. These scenarios have been modelled individually and also in combination in order to assess the Group’s ability to withstand multiple challenges, although the Directors do not believe a scenario combining all these risks to be plausible. The impact of these sensitivities has been reviewed against the Group’s projected cash flow position, available bank facilities and compliance with financial covenants. In the instance that a combination of the above scenarios arise, mitigating actions would be required to ensure that the Group remains liquid and financially viable, which might include a reduction of planned capital expenditure, freezing pay and recruitment and not paying a dividend to shareholders. All of the mitigating actions are within the Directors’ control. These forecasts, including the severe but plausible downsides, show that the Group is able to operate within its available banking facilities, with no forecasted covenant breaches, and that the Group will have sufficient funds to meet its liabilities as they fall due for that period. From a Company perspective, the Company places reliance on other Group trading entities for financial support. Having reviewed the current trading performance, forecasts, other Group trading entities‘ financial support, debt servicing requirements, total facilities and risks, the Directors are confident that the Company and the Group will have sufficient funds to continue to meet their liabilities as they fall due for a period of at least 12 months from the date of approval of these Financial Statements. Accordingly, they continue to adopt the going concern basis of accounting in preparing the Group’s Financial Statements for the year ended 31 May 2021. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 119 GovernanceGovernanceDirectors’ report Directors’ report continued Results and dividends The Group’s and Company’s audited Financial Statements for the financial year ended 31 May 2021 are set out on pages 133 to 186. The Company is not aware of any agreements between shareholders that may result in restrictions on the transfer of securities and/or voting rights. The Directors propose a final dividend of 3.15p per ordinary share, which, together with the interim dividend of 1.5p per ordinary share paid on 5 March 2021, makes a total dividend of 4.65p for the year. The Directors may refuse to register a transfer of shares in certificated form that are not fully paid up or otherwise in accordance with the Articles. Authority to purchase own shares At the AGM held on 20 October 2020, shareholders authorised the Company to make market purchases of up to 27,906,500 ordinary shares representing approximately 10% of the issued share capital. This authority was not used during the financial year ended 31 May 2021. At the 2021 AGM, shareholders will be asked to give a similar authority. The Company does not currently hold any ordinary shares in treasury. Directors Biographical details of the Company’s current Directors are set out on pages 74 and 75. Subject to law and the Company’s Articles of Association, the Directors may exercise all of the powers of the Company and may delegate their power and discretion to Committees. The Company’s Articles of Association give the Directors power to appoint and replace Directors. Under the terms of reference of the Nomination Committee, any appointment to the Board of the Company must be recommended by the Nomination Committee for approval by the Board. The Articles of Association also require one-third of the Directors to retire by rotation each year end and each Director must offer themself for re-election at least every three years. However, in accordance with previous years and in accordance with best practice, all Directors will submit themselves for re-election at the AGM each year. During the year, no Director had any material interest in any contract of significance in the Group’s business. Directors’ and Officers’ insurance and indemnities The Company maintains Directors’ and Officers’ liability insurance, which provides appropriate cover for any legal action brought against its Directors (including those who served as Directors or Officers during 2020/21). This cover was in place throughout the financial year ended 31 May 2021 and up to the date of this Directors’ Report. The Directors of the Company have also entered into individual deeds of indemnity with the Company which constitute as qualifying third party indemnity provisions for the purposes of section 234 of the Companies Act 2006. The deeds were in effect during the course of the financial year ended 31 May 2021 for the benefit of the Directors and, at the date of this report, are in force for the benefit of the Directors in relation to certain losses and liabilities which they may incur (or have incurred) in connection with their duties, powers or office. The final dividend will be paid on 12 November 2021, subject to approval at the AGM on 4 November 2021, to shareholders on the register at the close of business on 15 October 2021. The ex-dividend date is 14 October 2021. Post-Balance Sheet events On 1 June 2021, shareholder approval was passed for the acquisition of the IPM business of Iron Mountain, comprising substantially all of the assets of Iron Mountain Intellectual Property Management, Inc. together with certain other assets of affiliates of Iron Mountain exclusively related to the IPM business. Details of assets acquired that are subject to provisional fair value adjustments will be reported for the year ending 31 May 2022. The acquisition for a total consideration of $220m was funded through an equity gross placing of £72.6m (see Note 27) on 17 May 2021 combined with a new three year $70m term loan, existing cash balances and our revolving credit facility. The term loan was entered into on 12 May 2021 but not drawn down until 2 June 2021. See further details within Note 34 to the consolidated Financial Statements. Share capital and control At the AGM held on 20 October 2020, the Directors were granted authority to allot up to 93,021,700 ordinary shares representing approximately a third of the Company’s issued share capital. In addition, the Directors were granted authority to allot a further 93,021,700 ordinary shares, again representing approximately a third of the Company’s issued share capital, solely to be used in connection with a pre-emptive rights issue. As at 31 May 2021, the Company’s issued ordinary share capital comprised 308,956,045 ordinary shares with a nominal value of 1p each, of which no ordinary shares were held in treasury. During the year ended 31 May 2021, 2,140,474 shares in the Company were issued further to the exercise of options pursuant to the Company’s share option schemes. The holders of ordinary shares are entitled, among other rights, to receive the Company’s Annual Reports and Accounts, to attend and speak at general meetings of the Company, to appoint proxies and to exercise voting rights. Details of the movements of the called up share capital of the Company are set out in Note 27 to the Financial Statements and the information in this Note is incorporated by reference and forms part of this Directors’ Report. All rights and obligations attaching to the Company’s ordinary shares are set out in the Company’s Articles of Association (the ‘Articles’), copies of which can be obtained from the Companies House website or by writing to the Company Secretary. Unless otherwise provided in the Articles, the terms of issue of any shares, any restrictions from time to time imposed by laws or regulations (for example insider trading laws) or pursuant to the UK Market Abuse Regulations whereby certain Directors, officers and colleagues of the Group require the approval of the Company to deal in ordinary shares of the Company, any shareholder may transfer any or all of their shares. 120 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Colleagues The Group uses a number of ways to engage with its colleagues on matters that impact them and the performance of the Group. These include briefings by members of the Executive Committee, regular team meetings, the Group’s intranet site, global communications and update emails which together provide, among other information, an awareness of the financial and economic factors affecting the Company’s performance. Further information on how the Directors engage with colleagues along with how colleague interests are taken into account during decision making can be found within the Corporate Governance Report on page 80. We conduct a colleague engagement survey to ensure all colleagues are given a voice in the organisation. In 2018, using insights from our survey and subsequent colleague engagement, we defined new values for the organisation. Details of these values are set out in the Sustainability Report on page 60. We offer colleagues the opportunity to purchase ordinary shares in the Company through participation in the Company’s Save As You Earn Scheme. At the 2019 AGM, shareholders also approved a Share Incentive Plan. Both schemes help to encourage colleague interest in the performance of the Group. Equal opportunities The Group is committed to providing equality of opportunity to all colleagues without discrimination and applies fair and equitable employment policies which seek to promote entry into and progression within the Group. Appointments are determined solely by application of job criteria, personal ability, behaviour and competency. In the opinion of the Directors, all colleague policies are deemed to be effective and in accordance with their intended aims. Disabled persons Disabled persons have equal opportunities when applying for vacancies, with due regard to their aptitudes and abilities. Procedures ensure that disabled colleagues are fairly treated in respect of training and career development. For those colleagues becoming disabled during the course of their employment, the Group is supportive so as to provide an opportunity for them to remain with the Group, wherever reasonably practicable. Political donations During the year the Company made no political donations (2020: £nil). Sustainability Report The Company’s Sustainability Report on pages 53 to 68 provides an update on the Group’s policies and activities in respect of its wider stakeholders, including colleagues; community, environmental, ethical and health and safety issues; and modern slavery. Overseas branches As at 31 May 2021, the Group had no overseas branches. Research and development We are committed to using innovative, cost effective and practical solutions for providing high quality services and we recognise the importance of ensuring that we focus our investment on the development of technology. The Group’s research and development expenditure is predominantly associated with computer and software systems. Change of control In the event of a change of control of the Company, the Group and each of its lenders shall enter into negotiation for a period to determine how the Group’s loan facilities may continue and if after negotiation there is no agreement the lender has the right to cancel the commitment. There are no agreements between the Company and its Directors or colleagues providing for compensation for loss of office or employment (whether through resignation, purported redundancy or otherwise) that occurs because of a takeover bid. Disclosure of information to the auditor The Directors who held office at the date of approval of this Directors’ Report confirm that, so far as they are each aware, there is no relevant audit information of which the Company’s auditor is unaware; and each Director has taken all reasonable steps to ascertain any relevant audit information and ensure the auditor is aware of such information. Reappointment of auditor The Board approved the Audit Committee’s recommendation to put a resolution to shareholders recommending the reappointment of KPMG LLP as the Company’s auditor and KPMG LLP has indicated its willingness to accept the reappointment as auditor to the Company. The Audit Committee, in its recommendation, confirmed that (1) the recommendation was free from influence by a third party and (2) no contractual term of the kind mentioned in Article 16(6) of the EU Regulation 537/2014 has been imposed on the Company. A resolution to reappoint KPMG LLP as auditor will be put to the members at the AGM. Annual General Meeting The notice of the Company’s AGM to be held at 2pm on 4 November 2021 at its head office at XYZ Building, 2 Hardman Boulevard, Spinningfields, Manchester M3 3AQ, along with details of the business to be proposed and explanatory notes, will be available on the Group’s website together with the Annual Report and Accounts. All shareholders will be notified by post or email, at their request, when the documents have been made available. Although the Company is not expecting to be legally restricted in terms of attendance at the AGM, the Board remains committed to protecting the health and wellbeing of its shareholders and of the general public. Therefore, it is regrettably the opinion of the Board that due to the increase in the number of Covid-19 cases reported in the UK, shareholders should not physically attend the AGM. Accordingly, the Board strongly urges shareholders to consider whether travelling to and attending the AGM would be necessary under the current circumstances. In any event, attendees may be required to wear face coverings and will be required to keep a distance between themselves and other attendees. The Company will arrange for the AGM to be convened with the minimum necessary quorum, to conduct the necessary business of the AGM. The Company therefore strongly encourages all shareholders to appoint the Chair of the Meeting as their proxy and to submit their voting instructions electronically in advance of the Meeting, in accordance with the instructions contained in the Notice of AGM. Capitalised interest During the period, no interest was capitalised by the Group (2020: £nil). The tax benefit on this amount was £nil (2020: £nil). NCC Group plc — Annual report and accounts for the year ended 31 May 2021 121 GovernanceGovernanceDirectors’ report continued Reporting requirements The following sets out the location of additional information forming part of the Directors’ Report which is incorporated by reference into this report: Reporting requirement Location Board’s assessment of the Group’s internal control systems Details of uses of financial instruments and specific policies for managing financial risk Corporate Governance Report on pages 70 to 86 and Audit Committee Report on page 92 Note 25 (Financial Instruments) on pages 173 to 177 Directors’ interests Directors’ Remuneration Report on page 114 Directors’ Responsibilities Statement Directors’ Responsibilities Statement on page 123 Directors’ remuneration including disclosures required by Schedule 5 and Schedule 8 of SI2008/410 – Large and Medium-sized Companies and Groups (Accounts and Reports) Regulations 2008 Directors’ Remuneration Report on pages 109 to 118 DTR4.1.8.R – Management Report – the Directors’ Report and Strategic Report comprise the management report Directors’ Report on pages 119 to 122 and Strategic Report on pages 1 to 68 Going concern statement Chief Financial Officer’s Review on page 39 and going concern section within Note 1 on pages 140 to 151 Greenhouse gas emissions and energy consumption Sustainability Report on page 57 Likely future developments of the business and Group Strategic Report on pages 9 to 13 LR 9.8.4 (4) – Long-term incentive schemes Directors’ Remuneration Report on pages 109 and 113 to 115 LR 9.8.6 (2) – Substantial shareholders Statement on corporate governance Shareholder relations section of Corporate Governance Report on page 87 Corporate Governance Report, Audit Committee Report, Nomination Committee Report and Directors’ Remuneration Report on pages 70 to 118. Statement of compliance with the UK Corporate Governance Code is on page 72 Strategic Report – Companies Act 2006 section 414A-D Strategic Report on pages 1 to 68 The Strategic Report on pages 1 to 68 and this Directors’ Report on pages 119 to 122 have been approved and authorised for issue by the Board. They were signed on its behalf by: Adam Palser Chief Executive Officer 14 September 2021 Tim Kowalski Chief Financial Officer 14 September 2021 122 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Responsibility statement of the Directors in respect of the annual financial report We confirm that to the best of our knowledge: • The Financial Statements, prepared in accordance with the applicable set of accounting standards, give a true and fair view of the assets, liabilities, financial position and profit or loss of the Company and the undertakings included in the consolidation taken as a whole • The Strategic Report includes a fair review of the development and performance of the business and the position of the issuer and the undertakings included in the consolidation taken as a whole, together with a description of the principal risks and uncertainties that they face We consider the Annual Report and Accounts, taken as a whole, is fair, balanced and understandable and provides the information necessary for shareholders to assess the Group’s position and performance, business model and strategy. For and on behalf of the Board Adam Palser Chief Executive Officer 14 September 2021 Tim Kowalski Chief Financial Officer 14 September 2021 Directors’ responsibilities statement Statement of Directors’ responsibilities in respect of the Annual Report and Accounts and the Financial Statements The Directors are responsible for preparing the Annual Report and Accounts and the Group and Parent Company Financial Statements in accordance with applicable law and regulations. Company law requires the Directors to prepare Group and Parent Company Financial Statements for each financial year. Under that law they are required to prepare the Group Financial Statements in accordance with International Accounting Standards in conformity with the requirements of the Companies Act 2006 and applicable law and have elected to prepare the Parent Company Financial Statements on the same basis. In addition the Group Financial Statements are required under the Financial Conduct Authority’s Disclosure Guidance and Transparency Rules (DTRs) to be prepared in accordance with International Financial Reporting Standards adopted pursuant to Regulation (EC) No 1606/2002 as it applies in the European Union (‘IFRSs as adopted by the EU’). Under company law the Directors must not approve the Financial Statements unless they are satisfied that they give a true and fair view of the state of affairs of the Company and of the Group’s profit or loss for that period. In preparing each of the Group and Parent Company Financial Statements, the Directors are required to: • Select suitable accounting policies and then apply them consistently • Make judgements and estimates that are reasonable, relevant and reliable • State whether they have been prepared in accordance with International Accounting Standards in conformity with the requirements of the Companies Act 2006 and, as regards the Group Financial Statements, International Financial Reporting Standards adopted pursuant to Regulation (EC) No 1606/2002 as it applies in the European Union (‘IFRSs as adopted by the EU’) • Assess the Group and Parent Company’s ability to continue as a going concern, disclosing, as applicable, matters related to going concern • Use the going concern basis of accounting unless they either intend to liquidate the Group or the Parent Company or to cease operations, or have no realistic alternative but to do so The Directors are responsible for keeping adequate accounting records that are sufficient to show and explain the Parent Company’s transactions and disclose with reasonable accuracy at any time the financial position of the Parent Company and enable them to ensure that its Financial Statements comply with the Companies Act 2006. They are responsible for such internal control as they determine is necessary to enable the preparation of Financial Statements that are free from material misstatement, whether due to fraud or error, and have general responsibility for taking such steps as are reasonably open to them to safeguard the assets of the Group and to prevent and detect fraud and other irregularities. Under applicable law and regulations, the Directors are also responsible for preparing a Strategic Report, Directors’ Report, Directors’ Remuneration Report and Corporate Governance Statement that comply with that law and those regulations. The Directors are responsible for the maintenance and integrity of the corporate and financial information included on the Company’s website. Legislation in the UK governing the preparation and dissemination of Financial Statements may differ from legislation in other jurisdictions. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 123 GovernanceGovernance Financial statements Resilient financial performance IN THIS SECTION 125 Independent auditor’s report 133 Consolidated income statement 133 Consolidated statement of comprehensive (loss)/income 134 Consolidated balance sheet 135 Consolidated cash flow statement 136 Consolidated statement of changes in equity 137 Company balance sheet 138 Company cash flow statement 139 Company statement of changes in equity 140 Notes to the Financial Statements ADDITIONAL INFORMATION 187 Glossary of terms – Alternative Performance Measures (APMs) 189 Glossary of terms – other terms 191 Other information 192 Financial calendar 124 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Independent auditor’s report to the members of NCC Group plc 1 Our opinion is unmodified We have audited the financial statements of NCC Group plc (“the Company”) for the year ended 31 May 2021 which comprise the consolidated income statement, consolidated statement of comprehensive income, consolidated balance sheet, consolidated cash flow statement, consolidated statement of changes in equity, company balance sheet, company cash flow statement, company statement of changes in equity, and the related notes, including the accounting policies in note 1. In our opinion: • the financial statements give a true and fair view of the state of the Group’s and of the parent Company’s affairs as at 31 May 2021 and of the Group’s profit for the year then ended; • the Group financial statements have been properly prepared in accordance with international accounting standards in conformity with the requirements of the Companies Act 2006; • the parent Company financial statements have been properly prepared in accordance with international accounting standards in conformity with the requirements of, and as applied in accordance with, the provisions of, the Companies Act 2006; and • the financial statements have been prepared in accordance with the requirements of the Companies Act 2006 and, as regards the Group financial statements, Article 4 of the IAS Regulation to the extent applicable. Basis for opinion We conducted our audit in accordance with International Standards on Auditing (UK) (“ISAs (UK)”) and applicable law. Our responsibilities are described below. We believe that the audit evidence we have obtained is a sufficient and appropriate basis for our opinion. Our audit opinion is consistent with our report to the audit committee. We were first appointed as auditor by the directors on 1 November 2013. The period of total uninterrupted engagement is for the eight financial years ended 31 May 2021. We have fulfilled our ethical responsibilities under, and we remain independent of the Group in accordance with, UK ethical requirements including the FRC Ethical Standard as applied to listed public interest entities. No non-audit services prohibited by that standard were provided. Overview Materiality: Group financial statements as a whole £1.2m (2020: £0.8m) 4.5% (2020: 5.0%) of normalised Group profit before tax Coverage 87% (2020: 93%) of the total profit and losses that make up Group profit before tax Key audit matters Recurring risks: vs 2020 Recoverability of goodwill in EU Assurance cash generating unit (‘CGU’) Fox IT long term fixed price contract accounting Assurance revenue recognition in the cut off period Recoverability of parent company investments and intercompany receivables Event driven risks: Accounting treatment of costs related to cloud-based software arrangements Recognition of US research and development (‘R&D’) tax credits New New NCC Group plc — Annual report and accounts for the year ended 31 May 2021 125 Financial statements Independent auditor’s report continued to the members of NCC Group plc 2 Key audit matters: our assessment of risks of material misstatement Key audit matters are those matters that, in our professional judgement, were of most significance in the audit of the financial statements and include the most significant assessed risks of material misstatement (whether or not due to fraud) identified by us, including those which had the greatest effect on: the overall audit strategy; the allocation of resources in the audit; and directing the efforts of the engagement team. We summarise below the key audit matters, in decreasing order of audit significance, in arriving at our audit opinion above, together with our key audit procedures to address those matters and, as required for public interest entities, our results from those procedures. These matters were addressed, and our results are based on procedures undertaken, in the context of, and solely for the purpose of, our audit of the financial statements as a whole, and in forming our opinion thereon, and consequently are incidental to that opinion, and we do not provide a separate opinion on these matters. The risk Our response Accounting treatment of costs related to cloud-based software arrangements Costs related to cloud-based software £5.1m (2020 restated: £7.9m) Refer to page 91 (Audit Committee Report), page 142 (accounting policy) and page 151, page 156, pages 160–161 and pages 184–185 (financial disclosures) Accounting treatment Previously, the Group capitalised internal and external costs in respect of cloud-based software arrangements. In April 2021 the IFRS Interpretations Committee (‘IFRIC’) published an agenda decision on configuration and customisation costs incurred in implementing Software-as-a-Service (SaaS) arrangements. This IFRIC decision has been considered by the Group and the Group have identified that a change in accounting policy in respect of the capitalisation of certain costs associated with SaaS arrangements is required. The risk is that the accounting policy change is not appropriately applied to both the current and prior years. Recognition of US R&D Tax Credits US R&D net current tax benefit £2.7m and US R&D deferred tax asset £0.4m Uncertain tax position The Group submits R&D tax claims in the US. These claims are open to challenge by the Internal Revenue Service (‘IRS’). Refer to page 91 (Audit Committee Report), page 151 (accounting policy) and page 152, pages 158–159 and page 168 (financial disclosures) Unutilised tax credits of £1.0m remain open to challenge by the IRS as at 31 May 2021 and utilised tax credits of £7.2m. The Group have recognised a provision against these balances to reflect the uncertain tax position, therefore the net tax creditor and net deferred tax asset recognised in the accounts are £2.7m and £0.4m respectively. Therefore a risk exists in relation to the accounting estimation applied by management. The basis on which the Group has claimed R&D tax credits involves a technical assessment of which party is bearing economic risk in research contracts entered into with third parties. The risk has increased in year following the increase in quantum of claims, resulting in a high risk of material misstatement. The Group have engaged an external expert to assess these claims. The effect of these matters is that, as part of our risk assessment, we determined that the US R&D tax credit accounting has a high degree of estimation uncertainty with a potential range of outcomes greater than our materiality for the financial statements as a whole. The financial statements (note 2) disclose the range estimated by the Group. Our procedures included: • Accounting clarity: We assessed the accounting clarification of the IFRIC April 2021 decision against the proposed change in the Group’s accounting policy • Test of detail: We agreed a sample of costs related to cloud-based software arrangements to supporting documentation, including labour costs to timesheets and other relevant project information to understand the nature of the items and considered this against the accounting standards and related interpretations • Personnel enquiries: We interviewed selected employees who were assigned to projects to corroborate the nature of the work performed and considered this against the accounting standards and related interpretations • Assessing transparency: We assessed the adequacy of the Group’s related disclosures in respect of the change in accounting policy and the judgements taken by management Our results We found the accounting treatment of costs related to cloud-based software arrangements to be acceptable. Our procedures included: • Inspecting correspondence: We inspected correspondence with the Group’s tax advisors for both the current and historic claims • Assessment of experts: We assessed the competence, capabilities and objectivity of the external tax experts engaged by the Group • Tests of detail: Together with our own tax specialists, we challenged the appropriateness of recognition of the US R&D tax credits and the basis on which the claims have been made, focussing on economic risk and who bears this under the contractual arrangements entered into by the Group. We have challenged the findings of management’s experts, including performing sample testing on the findings of management’s experts • Assessing transparency: We assessed the adequacy of the Group’s related disclosures in respect of the uncertain tax position and the estimation uncertainty Our results We found the recognition of US R&D Tax Credits and the related disclosures to be acceptable. 126 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 2 Key audit matters: our assessment of risks of material misstatement continued The risk Our response Recoverability of goodwill in respect of EU Assurance cash generating Unit (‘CGU’) Goodwill £64.7m (2020: £64.3m before current year change in CGUs) Refer to page 90 (Audit Committee Report), pages 142–143 (accounting policy) and page 152 and pages 161–163 (financial disclosures) Fox IT long term fixed price contract accounting Revenue associated with long term contracts £1.8m (2020: £1.1m) Provision for long term contracts £1.1m (2020: £0.2m) Refer to page 91 (Audit Committee Report), page 149 (accounting policy) and page 152 and page 170 (financial disclosures) Forecast based valuation There is inherent uncertainty involved in forecasting and discounting future cash flows, which are the basis of the assessment of goodwill recoverability. The outcome could vary significantly if different assumptions were applied in the model. There is a risk of error, due to the judgemental and complex nature of the impairment model. This risk currently is specific to the EU Assurance Cash generating unit (‘CGU’). This is a result of limited headroom historically in the impairment model and the sensitivity of the value in use calculation to reasonably possible changes in key assumptions. We consider that the value-in-use calculation of EU Assurance has a high degree of estimation uncertainty, specifically around the revenue growth assumptions, with a potential range of reasonable outcomes greater than our materiality for the financial statements as a whole, and possibly many times that amount. The financial statements (note 12) disclose the sensitivity estimated by the Group. Our procedures included: • Historical comparison: We assessed the reasonableness of the forecast used, by considering the Group’s forecasting accuracy by comparing actual results in the year to the Group’s previous forecast for the year • Benchmarking assumptions: We challenged, with the support of our own valuation specialists, the risk adjusted discount rates, having regard for market observable data with regard to risk free rates and returns on equity for comparator companies. We also evaluated the revenue growth assumptions and the long-term growth rates into perpetuity, comparing to external sources of data including industry growth rates and internal sources including the order book • Sensitivity analysis: We performed breakeven analysis on the key assumptions, including the revenue compound annual growth rate (“CAGR”) and the discount rate • Comparing valuations: We compared the sum of the discounted cash flows to the Group’s market capitalisation adjusted for debt to assess the reasonableness of the value in use calculations • Assessing transparency: We assessed whether the Group’s disclosures regarding the sensitivity of the impairment assessment to changes in key assumptions reflected the risks inherent in the valuation of the goodwill Accounting treatment and subjective estimates The contractual arrangements that underpin the measurement of revenue and associated profit, within the long-term contracts within Fox IT can be complex. These involve judgements around the accounting treatment and subjective estimates, which form the basis of both the in-year and future recognition of revenue and profit. Incentives and pressures to meet market expectations, increase the risk of fraudulent revenue recognition. The significant risk relates to fixed price long term contracts that are not completed as at the balance sheet date. Within Fox IT, the forecasts used in assessing the contract outturn positions are inherently judgemental, due to the uncertainty involved in forecasting future cash flows, including costs to complete. Furthermore, where the fixed price contracts are loss-making or low margin, these assumptions may have a significant impact on the recognition of revenue and profit in the period and may result in impairment of related contract assets or further onerous contract provisions being required. The financial statements (note 2) disclose the sensitivity estimated by the Group. Our results We found the carrying value of the goodwill related to the EU Assurance CGU to be acceptable (2020 result: acceptable). Our procedures included: • Test of detail: For a sample of the selected contracts, we agreed costs incurred to date (such as direct costs, labour charges and hardware costs) to purchase orders and challenged the internal hours charged, to assess the stage of completion • Personnel enquiries: We corroborated forecasts used in the long-term contract accounting through discussions with operational management for the same sample of contracts regarding their expectations for the contracts, including forecast costs to complete and the timetable to completion for these contracts. We also periodically attended regular project meetings throughout the year to observe the project teams and challenge • Historical comparison: We assessed the forecasting accuracy of costs to complete by comparing actual results in the year to what was previously forecast • Assessing transparency: We assessed the completeness and accuracy of the matters covered in the disclosures relating to Fox IT long term contract accounting and assessed the adequacy of the Group’s disclosures about the sensitivity of the impact of reasonably possible changes in the key assumptions in the long term contract accounting Our results We found the accounting treatment and estimates of the revenue associated with long term contracts and the provisions for long term contracts and the related disclosures to be acceptable (2020 result: acceptable). NCC Group plc — Annual report and accounts for the year ended 31 May 2021 127 Financial statementsIndependent auditor’s report continued to the members of NCC Group plc 2 Key audit matters: our assessment of risks of material misstatement continued The risk Our response Assurance revenue recognition in the cut off period Contract assets – accrued income £21.3m; (2020: £17.6m) Contract liabilities – deferred income £32.6m; (2020: £29.7m) Refer to pages 144–149 (accounting policy) and pages 166 and 171 (financial disclosures) 2021/2022 sales Incentives and pressures to meet market expectations, increase the risk of fraudulent revenue recognition. There is a specific risk around the cut-off period at the year end, with regards to ensuring revenue, including accrued and deferred income are recognised in the correct accounting period. This is a particular risk for projects in the assurance business, where projects are ongoing at the year end and there are judgements taken in determining completion and progress to date. Recoverability of parent company’s investments in subsidiaries and intercompany receivables Investments – £151.8m (2020: £78.3m) Intercompany receivables £162.6m (2020: £142.0m) Refer to page 144 and 151 (accounting policy) and pages 166 and 182 (financial disclosures) Low risk, high value The carrying amount of the Parent Company’s investments in subsidiaries and intercompany receivables represents 48% (2020: 34%) and 52% (2020: 63%) respectively of the Company’s total assets. Their recoverability is not at a high risk of significant misstatement or subject to significant judgement. However, due to their materiality in the context of the Parent Company financial statements, this is the area that had the greatest effect on our overall Parent Company audit. Our procedures included: • Tests of detail: We agreed a sample of revenue transactions within the cut off period pre and post year end to supporting documentation to assess whether these have been recorded in the correct accounting period. This also included specific item testing of a sample of items held in accrued and deferred income at the year end. We performed an assessment of whether over and under statements of revenue, accrued income and deferred income identified through these procedures were material • Analytic Sampling: We also used data & analytics tools to identify journals with unusual account combinations involving revenue and performed testing over the identified items. This included procedures to understand the nature and substance of the transaction and obtaining supporting documentation Our results We found the recognition of Assurance revenue in the cut-off period to be acceptable (2020 result: acceptable). Our procedures included: • Tests of detail: We compared the carrying amount of investments and intercompany receivables with the relevant subsidiaries’ draft balance sheet as at 31 May 2021 to identify whether their net assets, being an approximation of their minimum recoverable amount, were in excess of their carrying amount and assessing whether those subsidiaries have historically been profit-making • Assessing subsidiary audits: We assessed the work performed by the group and subsidiary audit team on a sample of those subsidiaries and considering the results of that work, on those subsidiaries’ profits and net assets Our results We found the Group’s assessment of the recoverability of the parent company’s investment in subsidiaries to be acceptable (2020 result: acceptable). For each of the key audit matters reported, we performed the detailed tests above rather than seeking to rely on any of the Group’s controls. This is because our knowledge of the design of these controls indicated that we would not be able to obtain the required evidence to support reliance on controls. We continue to perform procedures over going concern and the impact of uncertainties due to the UK exiting the European Union on our audit. However, following the Group’s trading in the period, as well as the UK’s departure from the European Union and the end of the transition period in January 2021, we have not assessed these as one of the most significant risks in our current year audit and, therefore, they are not separately identified in our report this year. 128 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 3 Our application of materiality and an overview of the scope of our audit Materiality for the Group financial statements as a whole was set at £1.2 million (2020: £0.8 million), determined with reference to a benchmark of Group profit before tax, normalised to exclude individually significant items as disclosed in note 5 of £27.5 million (2020: profit before tax of £16.1 million, as stated in the accounts before the prior period restatement), of which it represents 4.5% (2020: 5.0%). Materiality for the Parent Company financial statements as a whole was set at £0.3 million (2020: £0.3 million), determined with reference to a benchmark of Company total assets, of which it represents 0.1% (2020: 0.1%). In line with our audit methodology, our procedures on individual account balances and disclosures were performed to a lower threshold, performance materiality, so as to reduce to an acceptable level the risk that individually immaterial misstatements in individual account balances add up to a material amount across the financial statements as a whole. Performance materiality was set at 65% (2020: 65%) of materiality for the financial statements as a whole, which equates to £0.78 million (2020: £0.5 million) for the Group and £0.2 million (2020: £0.2 million) for the parent company. We applied this percentage in our determination of performance materiality based on the level of identified misstatements and control deficiencies during the prior period. We agreed to report to the Audit Committee any corrected or uncorrected identified misstatements exceeding £60,000 (2020: £40,000), in addition to other identified misstatements that warranted reporting on qualitative grounds. Of the Group’s 41 (2020: 23) reporting components, we subjected 8 (2020: 10) to full scope audits for Group purposes. We conducted reviews of financial information (including enquiry) at a further 4 (2020: 4) non-significant components as these components were not individually financially significant enough to require an audit for Group reporting purposes but a review was performed to provide further coverage over the Group’s results. The components within the scope of our work accounted for the percentages illustrated opposite. For the residual components, we performed analysis at an aggregated group level to re-examine our assessment that there were no significant risks of material misstatement within these. The Group team instructed component auditors as to the significant areas to be covered, including the relevant risks detailed above and the information to be reported back. The Group team approved the component materialities, which ranged from £0.22m to £0.55m (2020: £0.10m to £0.63m), having regard to the mix of size and risk profile of the Group across the components. The work on 1 of the 41 components (2020: 1 of the 23 components) was performed by component auditors and the rest, including the audit of the Parent Company, was performed by the Group team. The Group team held video and telephone conference meetings with 1 (2020: 1) component location in the Netherlands to assess the audit risk and strategy as well as updates on performance. Video and telephone conference meetings were also held with the component auditors for the Netherlands. At these meetings, the audit findings reported to the Group team were discussed in more detail, and any further work required by the Group team was then performed by the component auditor. Normalised Group profit before tax £27.5m (2020: £16.1m) 96++4++II Normalised PBT Group materiality Group revenue 8 9 86 86 Group total assets 94% (2020: 95%) I86+86+ 86+86+ I96+96+ 92+92+ 95% (2020: 98%) 92 96 3 2 Group materiality £1.2m (2020: £0.8m) £1.2m Whole financial statements materiality (2020: £0.8m) £0.78m Whole financial statements performance materiality (2020: £0.5m) £0.55m Range of materiality at 8 components (£0.22m–£0.55m) (2020: £0.10m to £0.63m) £0.06m Misstatements reported to the audit committee (2020: £0.04m) 6 2 87 87 Total profits and losses that made up Group profit before tax 89% (2020: 93%) I87+87+ 87+87+ I80+80+ 88+88+ Total profits and losses that made up Group profit before individually significant items and tax 90% (2020: 93%) 10 88 80 2 Full scope for group audit purposes 2021 Reviews of financial information (including enquiry) 2021 Full scope for group audit purposes 2020 Reviews of financial information (including enquiry) 2020 The US components were audited remotely by the Group audit team. Residual components NCC Group plc — Annual report and accounts for the year ended 31 May 2021 129 Financial statements8 8 + + 6 6 + + I 9 9 + + 5 5 + + I I 2 2 + + 11 11 + + I 6 6 + + 7 7 + + I I 3 3 + + 5 5 + + I 2 2 + + 2 2 + + I I 2 2 + + 10 10 + + I 10 10 + + 10 10 + + I I Independent auditor’s report continued to the members of NCC Group plc 4 Going concern The Directors have prepared the financial statements on the going concern basis as they do not intend to liquidate the Group or the Company or to cease their operations, and as they have concluded that the Group’s and the Company’s financial position means that this is realistic. They have also concluded that there are no material uncertainties that could have cast significant doubt over their ability to continue as a going concern for at least a year from the date of approval of the financial statements (“the going concern period”). We used our knowledge of the Group, including the post-year end acquisition of trade and assets of Iron Mountain Intellectual Property Management Inc., its industry, and the general economic environment to identify the inherent risks to its business model and analysed how those risks might affect the Group’s and Company’s financial resources or ability to continue operations over the going concern period. The risk that we considered most likely to adversely affect the Group’s and Company’s available financial resources, and metrics relevant to debt covenants, over this period was in respect of the economic impact of COVID-19, with uncertainty remaining over the full range of possible effects on the Group’s financial and operational performance. We also considered less predictable but realistic second order impacts, such as the erosion of customer confidence. We considered whether these risks could plausibly affect the liquidity or covenant compliance in the going concern period by comparing severe, but plausible downside scenarios that could arise from these risks, individually and collectively, against the level of available financial resources and covenants indicated by the Group’s financial forecasts. Our procedures also included: • A review of the availability of cash and the cash flow forecasts to determine whether the assumptions are realistic, achievable and consistent with the external and internal environment; we assessed loan covenant compliance to consider the headroom forecast for each financial covenant; • An evaluation of sensitivities over the level of financial resources indicated by the Group’s financial forecasts, taking account of reasonably possible (but not unrealistic) adverse effects that could arise from the risks identified individually and collectively; • An assessment of the adequacy of the going concern disclosure in note 1 to the financial statements. Our conclusions based on this work: • we consider that the directors’ use of the going concern basis of accounting in the preparation of the financial statements is appropriate; • we have not identified, and concur with the directors’ assessment that there is not, a material uncertainty related to events or conditions that, individually or collectively, may cast significant doubt on the Group’s or Company’s ability to continue as a going concern for the going concern period; • we have nothing material to add or draw attention to in relation to the directors’ statement in note 1 to the financial statements on the use of the going concern basis of accounting with no material uncertainties that may cast significant doubt over the Group and Company’s use of that basis for the going concern period, and we found the going concern disclosure in note 1 to be acceptable; and • the related statement under the Listing Rules set out on page 119 is materially consistent with the financial statements and our audit knowledge. However, as we cannot predict all future events or conditions and as subsequent events may result in outcomes that are inconsistent with judgements that were reasonable at the time they were made, the above conclusions are not a guarantee that the Group or the Company will continue in operation. 5 Fraud and breaches of laws and regulations – ability to detect Identifying and responding to risks of material misstatement due to fraud To identify risks of material misstatement due to fraud (“fraud risks”) we assessed events or conditions that could indicate an incentive or pressure to commit fraud or provide an opportunity to commit fraud. Our risk assessment procedures included: • Enquiring of directors, the audit committee and internal audit; and inspection of policy documentation as to the Group’s high-level policies and procedures to prevent and detect fraud, including the internal audit function, and the Group’s channel for “whistleblowing”, as well as whether they have knowledge of any actual, suspected or alleged fraud • Reading Board, audit committee and remuneration committee minutes • Considering remuneration incentive schemes and performance targets for directors including the EPS target for management remuneration • Using analytical procedures to identify any unusual or unexpected relationships We communicated identified fraud risks throughout the audit team and remained alert to any indications of fraud throughout the audit. This included communication from the Group to the component audit team of relevant fraud risks identified at the Group level and request to the component audit team to report to the Group audit team any instances of fraud that could give rise to a material misstatement at Group. As required by auditing standards, and taking into account possible pressures to meet expectations of third parties, we perform procedures to address the risk of management override of controls and the risk of fraudulent revenue recognition, in particular the risk that Assurance revenue is recorded in the wrong period and the risk that Group and component management may be in a position to make incorrect accounting entries, and the risk of bias in accounting estimates and judgements such as provisions against long term contracts. On this audit we do not believe there is a fraud risk related to Software resilience revenue recognition because there is minimal opportunity for manipulation since the revenue stream is relatively straightforward and is typically based on annual agreements which set out the period over which revenue is to be recognised. We did not identify any additional fraud risks. Further detail in respect of Assurance revenue recognition and Fox IT long term fixed price contracts are set out in the key audit matter disclosures in section 2 of this report. We also performed procedures including: • Cut-off sample testing around the year end over assurance revenue, accrued income and deferred income; • Assessing significant accounting estimates for bias; • Identifying journal entries to test for all full scope components using data analytics tools based on risk criteria and comparing the identified entries to supporting documentation. These included those posted to unusual accounts. 130 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 5 Fraud and breaches of laws and regulations – ability to detect continued Identifying and responding to risks of material misstatement due to non-compliance with laws and regulations We identified areas of laws and regulations that could reasonably be expected to have a material effect on the financial statements from our general commercial and sector experience, and through discussion with the directors and other management (as required by auditing standards), and discussed with the directors and other management the policies and procedures regarding compliance with laws and regulations. As the Group is regulated, our assessment of risks involved gaining an understanding of the control environment including the entity’s procedures for complying with regulatory requirements. We communicated identified laws and regulations throughout our team and remained alert to any indications of non-compliance throughout the audit. This included communication from the Group to the component audit team of relevant laws and regulations identified at the Group level, and a request for component auditors to report to the Group team any instances of non-compliance with laws and regulations that could give rise to a material misstatement at Group. The potential effect of these laws and regulations on the financial statements varies considerably. Firstly, the Group is subject to laws and regulations that directly affect the financial statements including financial reporting legislation (including related companies legislation), distributable profits legislation and taxation legislation, and we assessed the extent of compliance with these laws and regulations as part of our procedures on the related financial statement items. Secondly, the Group is subject to many other laws and regulations where the consequences of non-compliance could have a material effect on amounts or disclosures in the financial statements, for instance through the imposition of fines or litigation. We identified the following areas as those most likely to have such an effect: health and safety, employment law and certain aspects of company legislation recognising the nature of the Group’s activities and its legal form. Auditing standards limit the required audit procedures to identify non-compliance with these laws and regulations to enquiry of the directors and other management and inspection of regulatory and legal correspondence, if any. Therefore if a breach of operational regulations is not disclosed to us or evident from relevant correspondence, an audit will not detect that breach. We assessed the legality of the distribution in the period based on the level of distributable reserves available when the distributions were approved. Context of the ability of the audit to detect fraud or breaches of law or regulation Owing to the inherent limitations of an audit, there is an unavoidable risk that we may not have detected some material misstatements in the financial statements, even though we have properly planned and performed our audit in accordance with auditing standards. For example, the further removed non-compliance with laws and regulations is from the events and transactions reflected in the financial statements, the less likely the inherently limited procedures required by auditing standards would identify it. misstatement. We are not responsible for preventing non-compliance or fraud and cannot be expected to detect non-compliance with all laws and regulations. 6 We have nothing to report on the other information in the Annual Report The directors are responsible for the other information presented in the Annual Report together with the financial statements. Our opinion on the financial statements does not cover the other information and, accordingly, we do not express an audit opinion or, except as explicitly stated below, any form of assurance conclusion thereon. Our responsibility is to read the other information and, in doing so, consider whether, based on our financial statements audit work, the information therein is materially misstated or inconsistent with the financial statements or our audit knowledge. Based solely on that work we have not identified material misstatements in the other information. Strategic report and directors’ report Based solely on our work on the other information: • we have not identified material misstatements in the strategic report and the directors’ report; • in our opinion the information given in those reports for the financial year is consistent with the financial statements; and • in our opinion those reports have been prepared in accordance with the Companies Act 2006. Directors’ remuneration report In our opinion the part of the Directors’ Remuneration Report to be audited has been properly prepared in accordance with the Companies Act 2006. Disclosures of emerging and principal risks and longer-term viability We are required to perform procedures to identify whether there is a material inconsistency between the directors’ disclosures in respect of emerging and principal risks and the viability statement, and the financial statements and our audit knowledge. Based on those procedures, we have nothing material to add or draw attention to in relation to: • the directors’ confirmation within the Viability Statement on page 48 that they have carried out a robust assessment of the emerging and principal risks facing the Group, including those that would threaten its business model, future performance, solvency and liquidity; • the Principal Risks and Uncertainties disclosures describing these risks and how emerging risks are identified, and explaining how they are being managed and mitigated; and • the directors’ explanation in the Viability Statement of how they have assessed the prospects of the Group, over what period they have done so and why they considered that period to be appropriate, and their statement as to whether they have a reasonable expectation that the Group will be able to continue in operation and meet its liabilities as they fall due over the period of their assessment, including any related disclosures drawing attention to any necessary qualifications or assumptions. In addition, as with any audit, there remained a higher risk of non-detection of fraud, as these may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal controls. Our audit procedures are designed to detect material We are also required to review the Viability Statement, set out on page 48 under the Listing Rules. Based on the above procedures, we have concluded that the above disclosures are materially consistent with the financial statements and our audit knowledge. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 131 Financial statementsIndependent auditor’s report continued to the members of NCC Group plc 6 We have nothing to report on the other information in the Annual Report continued Disclosures of emerging and principal risks and longer-term viability continued Our work is limited to assessing these matters in the context of only the knowledge acquired during our financial statements audit. As we cannot predict all future events or conditions and as subsequent events may result in outcomes that are inconsistent with judgements that were reasonable at the time they were made, the absence of anything to report on these statements is not a guarantee as to the Group’s and Company’s longer-term viability. Corporate governance disclosures We are required to perform procedures to identify whether there is a material inconsistency between the directors’ corporate governance disclosures and the financial statements and our audit knowledge. Based on those procedures, we have concluded that each of the following is materially consistent with the financial statements and our audit knowledge: • the directors’ statement that they consider that the annual report and financial statements taken as a whole is fair, balanced and understandable, and provides the information necessary for shareholders to assess the Group’s position and performance, business model and strategy; • the section of the annual report describing the work of the Audit Committee, including the significant issues that the Audit Committee considered in relation to the financial statements, and how these issues were addressed; and • the section of the annual report that describes the review of the effectiveness of the Group’s risk management and internal control systems. We are required to review the part of the Corporate Governance Statement relating to the Group’s compliance with the provisions of the UK Corporate Governance Code specified by the Listing Rules for our review. We have nothing to report in this respect. 7 We have nothing to report on the other matters on which we are required to report by exception Under the Companies Act 2006, we are required to report to you if, in our opinion: • adequate accounting records have not been kept by the parent Company, or returns adequate for our audit have not been received from branches not visited by us; or • the parent Company financial statements and the part of the Directors’ Remuneration Report to be audited are not in agreement with the accounting records and returns; or • certain disclosures of directors’ remuneration specified by law are not made; or • we have not received all the information and explanations we require for our audit. We have nothing to report in these respects. 8 Respective responsibilities Directors’ responsibilities As explained more fully in their statement set out on page 123, the directors are responsible for: the preparation of the financial statements including being satisfied that they give a true and fair view; such internal control as they determine is necessary to enable the preparation of financial statements that are free from material misstatement, whether due to fraud or error; assessing the Group and parent Company’s ability to continue as a going concern, disclosing, as applicable, matters related to going concern; and using the going concern basis of accounting unless they either intend to liquidate the Group or the parent Company or to cease operations, or have no realistic alternative but to do so. Auditor’s responsibilities Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue our opinion in an auditor’s report. Reasonable assurance is a high level of assurance, but does not guarantee that an audit conducted in accordance with ISAs (UK) will always detect a material misstatement when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements. A fuller description of our responsibilities is provided on the FRC’s website at www.frc.org.uk/auditorsresponsibilities. 9 The purpose of our audit work and to whom we owe our responsibilities This report is made solely to the Company’s members, as a body, in accordance with Chapter 3 of Part 16 of the Companies Act 2006. Our audit work has been undertaken so that we might state to the Company’s members those matters we are required to state to them in an auditor’s report and for no other purpose. To the fullest extent permitted by law, we do not accept or assume responsibility to anyone other than the Company and the Company’s members, as a body, for our audit work, for this report, or for the opinions we have formed. Frances Simpson (Senior Statutory Auditor) for and on behalf of KPMG LLP, Statutory Auditor Chartered Accountants 1 St. Peter’s Square Manchester M2 3AE United Kingdom 14 September 2021 132 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Consolidated income statement 1 for the year ended 31 May 2021 Revenue Cost of sales Gross profit Administrative expenses Depreciation and amortisation Other administrative expenses Individually Significant Items Total administrative expenses Operating profit Finance costs Profit before taxation Taxation Profit for the year attributable to the owners of the Company Earnings per ordinary share Basic EPS Diluted EPS Notes 4 4 4 5 4 8 6 9 11 2021 £m 270.5 (159.9) 2020 (restated) 2, 3 £m 263.7 (159.3) 110.6 104.4 (19.7) (60.9) (12.7) (93.3) 17.3 (2.5) 14.8 (4.8) 10.0 (23.6) (60.3) (7.9) (91.8) 12.6 (3.0) 9.6 (3.2) 6.4 3.6p 3.5p 2.3p 2.3p Consolidated statement of comprehensive (loss)/income for the year ended 31 May 2021 Profit for the year attributable to the owners of the Company Other comprehensive (loss)/income Items that may be reclassified subsequently to profit or loss (net of tax) Cash flow hedges – effective portion of changes in fair value Foreign exchange translation differences Total other comprehensive (loss)/income Total comprehensive (loss)/income for the year (net of tax) attributable to the owners of the Company The accompanying Notes 1 to 35 are an integral part of these consolidated Financial Statements. 2021 £m 10.0 2020 (restated) 2 £m 6.4 (0.8) (11.6) (12.4) (2.4) – 4.0 4.0 10.4 Footnotes for consolidated Financial Statements 1 See Note 3 for an explanation of Alternative Performance Measures (APMs) and adjusting items, including a reconciliation to statutory information. Further information is also contained within the Glossary of terms on pages 187 and 188. 2 See Note 34 for an explanation of the prior year restatement recognised in relation to the adoption of the IFRIC agenda decision on cloud configuration and customisation costs in April 2021. 3 Results for the year ended 31 May 2020 have been re-presented to include adjusting items within statutory results. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 133 Financial statements Consolidated balance sheet at 31 May 2021 Non-current assets Goodwill Intangible assets Property, plant and equipment Right-of-use assets Investments Deferred tax asset Total non-current assets Current assets Inventories Trade and other receivables Current tax receivable Cash and cash equivalents Total current assets Total assets Current liabilities Trade and other payables Borrowings Lease liabilities Current tax payable Derivative financial instruments Provisions Contract liabilities – deferred revenue Total current liabilities Non-current liabilities Borrowings Lease liabilities Deferred tax liabilities Provisions Contract liabilities – deferred revenue Total non-current liabilities Total liabilities Net assets Equity Share capital Share premium Hedging reserve Merger reserve Currency translation reserve Retained earnings 31 May 2021 £m Notes 31 May 2020 1 June 2019 (restated) 2 (restated) 2 £m £m 12 12 13 14 15 18 16 17 24 19 24 20 25 21 22 24 20 18 21 22 27 27 27 27 27 27 182.9 193.1 189.4 21.0 11.5 23.8 0.3 2.0 29.0 13.9 28.7 0.3 2.3 38.3 16.9 26.5 0.3 2.2 241.5 267.3 273.6 1.1 68.7 4.5 116.5 190.8 432.3 45.2 – 5.1 4.0 0.8 2.4 43.6 101.1 33.2 29.3 1.2 0.6 0.7 65.0 166.1 266.2 3.1 223.2 (0.8) 42.3 20.3 (21.9) 0.9 73.4 0.6 95.0 169.9 437.2 46.4 – 5.3 – – 2.0 39.5 93.2 99.2 32.9 2.9 1.7 1.4 138.1 231.3 205.9 2.8 150.9 – 42.3 31.9 0.7 61.6 0.6 34.9 97.8 371.4 31.6 5.0 5.2 – – 0.2 36.2 78.2 50.1 30.5 5.4 1.3 – 87.3 165.5 205.9 2.8 149.8 – 42.3 27.9 (22.0) (16.9) Total equity attributable to equity holders of the Parent 266.2 205.9 205.9 The accompanying Notes 1 to 35 are an integral part of these consolidated Financial Statements. These Financial Statements were approved and authorised for issue by the Board of Directors on 14 September 2021. They were signed on its behalf by: Adam Palser Chief Executive Officer 14 September 2021 Tim Kowalski Chief Financial Officer 14 September 2021 134 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Consolidated cash flow statement for the year ended 31 May 2021 Cash flows from operating activities Profit for the year Adjustments for: Depreciation of property, plant and equipment Depreciation of right-of-use assets Share-based payments Amortisation of customer contracts and relationships Amortisation of software and development costs Impairment of right-of-use assets Lease financing costs Other financing costs Foreign exchange Acquisition of businesses – transaction costs Individually Significant Items (non-cash impact) Profit on disposal of right-of-use assets Profit on sale of intangible assets Loss on sale of property, plant and equipment Research and development UK tax credits Research and development US tax credits Income tax expense Increase in provisions Cash inflow for the year before changes in working capital Decrease/(increase) in trade and other receivables Increase in inventories (Decrease)/increase in trade and other payables Cash generated from operating activities before interest and taxation Interest element of lease payments Other interest paid Taxation paid Net cash generated from operating activities Cash flows from investing activities Purchase of property, plant and equipment Software and development expenditure Net proceeds from sale of intangible assets Net cash used in investing activities Cash flows from financing activities Proceeds from the issue of ordinary share capital Principal element of lease payments Drawdown of borrowings (net of deferred issue costs) Issue costs related to borrowings Repayment of borrowings Equity dividends paid Net cash (used in)/generated from financing activities Net increase in cash and cash equivalents Cash and cash equivalents at beginning of year Effect of foreign currency exchange rate changes Cash and cash equivalents at end of year Reconciliation of net change in cash and cash equivalents to movement in net cash/(debt) 1 Net increase in cash and cash equivalents Change in net debt 1 resulting from cash flows (net of deferred issue costs) Interest incurred on borrowings Interest paid on borrowings Non-cash movements (release of deferred issue costs) Effect of foreign currency on cash flows Foreign currency translation differences on borrowings Change in net cash/(debt) 1 during the year Net debt 1 at start of year excluding lease liabilities Net cash/(debt) 1 at end of year excluding lease liabilities Lease liabilities Net cash/(debt) 1 at end of year The accompanying Notes 1 to 35 are an integral part of these consolidated Financial Statements. Notes 13 14 26 12 12 14 8 8 5 9 9 27 10 24 2021 £m 10.0 4.4 5.9 2.8 6.4 3.0 – 1.2 1.3 1.5 (1.2) 7.6 (0.2) (0.5) 0.2 (0.6) 1.9 2.9 0.7 47.3 4.7 (0.2) (5.5) 46.3 (1.2) (1.1) (5.1) 38.9 (2.7) (2.1) 0.5 (4.3) 72.6 (6.0) – – (60.4) (13.0) (6.8) 27.8 95.0 (6.3) 116.5 2021 £m 27.8 60.4 (1.1) 1.1 (0.2) (6.3) 5.8 87.5 (4.2) 83.3 (34.4) 48.9 2020 (restated) 2 £m 6.4 5.8 6.0 1.4 8.8 3.0 1.1 1.2 1.8 – – – (0.1) – – (0.6) 0.5 2.7 0.8 38.8 (11.0) (0.2) 19.2 46.8 (1.2) (1.6) (4.8) 39.2 (2.8) (2.5) – (5.3) 1.1 (5.3) 44.3 (1.0) – (12.9) 26.2 60.1 34.9 – 95.0 2020 £m 60.1 (43.3) (1.6) 1.6 (0.2) – (0.6) 16.0 (20.2) (4.2) (38.2) (42.4) NCC Group plc — Annual report and accounts for the year ended 31 May 2021 135 Financial statements Consolidated statement of changes in equity for the year ended 31 May 2021 Share capital £m Share premium £m Hedging reserve £m Notes Balance at 1 June 2019 (as reported) 2.8 149.8 Impact of change in accounting policy in respect of cloud configuration and customisation costs (Note 34) Balance at 1 June 2019 (as restated) 2 Profit for the year (as restated) 2 (Note 34) Other comprehensive income for the year Total comprehensive income for the year (restated) 2 Transactions with owners recorded directly in equity Dividends to equity shareholders Share-based payments Shares issued 10 26 27 Total contributions by and distributions to owners – 2.8 – 149.8 – – – – – – – – – – – – 1.1 1.1 Balance at 31 May 2020 (restated) 2 2.8 150.9 Profit for the year Other comprehensive income for the year Total comprehensive income for the year Transactions with owners recorded directly in equity Dividends to equity shareholders Share-based payments Tax on share-based payments Shares issued Total contributions by and distributions to owners Balance at 31 May 2021 10 26 26 27 – – – – – – 0.3 0.3 3.1 – – – – – – 72.3 72.3 223.2 Merger reserve £m 42.3 Currency translation reserve £m Retained earnings £m Total £m 27.9 (14.0) 208.8 – – (2.9) (2.9) 42.3 27.9 (16.9) 205.9 – – – – – – – – 4.0 4.0 – – – – 6.4 – 6.4 6.4 4.0 10.4 (12.9) (12.9) 1.4 – 1.4 1.1 (11.5) (10.4) 42.3 31.9 (22.0) 205.9 – – – – – – – – – (11.6) (11.6) 10.0 – 10.0 10.0 (12.4) (2.4) – – – – – (13.0) (13.0) 2.8 0.3 – 2.8 0.3 72.6 (9.9) 62.7 – – – – – – – – – – – – (0.8) (0.8) – – – – – (0.8) 42.3 20.3 (21.9) 266.2 The accompanying Notes 1 to 35 are an integral part of these consolidated Financial Statements. 136 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Company balance sheet at 31 May 2021 Company no: 4627044 Non-current assets Investments in subsidiary undertakings Trade and other receivables Total non-current assets Current assets Cash and cash equivalents Total current assets Total assets Current liabilities Trade and other payables Total current liabilities Total liabilities Net assets Equity Share capital Share premium Merger reserve Retained earnings Total equity Notes 2021 £m 2020 £m 33 17 24 19 27 27 27 27 151.8 162.6 314.4 0.6 0.6 78.3 142.0 220.3 6.8 6.8 315.0 227.1 13.5 13.5 13.5 13.0 13.0 13.0 301.5 214.1 3.1 223.2 42.3 32.9 301.5 2.8 150.9 42.3 18.1 214.1 The accompanying Notes 1 to 35 are an integral part of these Financial Statements. These Financial Statements were approved and authorised for issue by the Board of Directors on 14 September 2021. They were signed on its behalf by: Adam Palser Chief Executive Officer 14 September 2021 Tim Kowalski Chief Financial Officer 14 September 2021 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 137 Financial statements Company cash flow statement for the year ended 31 May 2021 Cash flows from operating activities Profit for the year Cash inflow for the year before changes in working capital Increase in trade and other receivables Increase in trade and other payables Net cash generated from operating activities Cash flows from investing activities Investments in subsidiary undertakings Net cash used in investing activities Cash flows from financing activities Proceeds from the issue of ordinary share capital Equity dividends paid Net cash generated from/(used in) financing activities Net (decrease)/increase in cash and cash equivalents Cash and cash equivalents at beginning of year Cash and cash equivalents at end of year The accompanying Notes 1 to 35 are an integral part of these Financial Statements. Notes 28 32 27 10 2021 £m 2020 £m 25.0 25.0 (20.6) 0.5 4.9 (70.7) (70.7) 72.6 (13.0) 59.6 (6.2) 6.8 0.6 6.0 6.0 (0.6) 13.0 18.4 – – 1.1 (12.9) (11.8) 6.6 0.2 6.8 138 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Company statement of changes in equity for the year ended 31 May 2021 Balance at 31 May 2019 and 1 June 2019 Profit for the year Total comprehensive income for the year Transactions with owners recorded directly in equity Dividends to equity shareholders Increase in subsidiary investment for share-based charges Shares issued Total contributions by and distributions to owners Balance at 31 May 2020 Profit for the year Total comprehensive income for the year Transactions with owners recorded directly in equity Dividends to equity shareholders Increase in subsidiary investment for share-based charges Shares issued Total contributions by and distributions to owners Balance at 31 May 2021 Notes Share capital £m Share premium £m 2.8 149.8 Merger reserve £m 42.3 10 27 10 27 – – – – – – – – – – 1.1 1.1 – – – – – – 2.8 150.9 42.3 – – – – 72.3 72.3 – – – – – – – – – – 0.3 0.3 3.1 Retained earnings £m Total £m 21.9 216.8 6.0 6.0 6.0 6.0 (12.9) (12.9) 3.1 – (9.8) 18.1 25.0 25.0 3.1 1.1 (8.7) 214.1 25.0 25.0 (13.0) (13.0) 2.8 – (10.2) 2.8 72.6 62.4 223.2 42.3 32.9 301.5 The accompanying Notes 1 to 35 are an integral part of these Financial Statements. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 139 Financial statementsNotes to the Financial Statements for the year ended 31 May 2021 1 Accounting policies Basis of preparation NCC Group plc (the ‘Company’) is a company incorporated in the UK, with its registered office at XYZ Building, 2 Hardman Boulevard, Manchester M3 3AQ. The Group Financial Statements consolidate those of the Company and its subsidiaries (together referred to as the ‘Group’). The principal activity of the Group is the provision of independent advice and services to customers through the supply of cyber assurance and Software Resilience services. The Parent Company Financial Statements present information about the Company as a separate entity and not about the Group. These Financial Statements have been approved for issue by the Board of Directors on 14 September 2021. These Group and Parent Company Financial Statements were prepared in accordance with International Accounting Standards in conformity with the requirements of the Companies Act 2006 and these Group Financial Statements were also in accordance with International Financial Reporting Standards adopted pursuant to Regulation (EC) No 1606/2002 as it applies in the European Union (‘IFRSs as adopted by the EU’). On publishing the Parent Company Financial Statements here together with the Group Financial Statements, the Company is also taking advantage of the exemption in s408 of the Companies Act 2006 not to present its individual Income Statement and related notes that form a part of these approved Financial Statements. Brexit Management has reviewed the impact of Brexit on the Financial Statements. The Group has so far proven structurally resilient to any significant disruption caused by Brexit. The main risks to the Group from Brexit continue to be any reduction in demand from an economic slowdown as well as real or perceived differences in data protection standards which impact our global ways of working. On this basis, management has concluded that the impact should be limited; this includes any impact on the IFRS 9 expected credit loss model. Management also notes no changes to this assessment from a post-Balance Sheet event perspective. Covid-19 Management has reviewed the potential impact of Covid-19 on the Financial Statements. Accordingly, consideration has been given to the impact on the IFRS 9 expected credit loss model, IFRS 15 collectability assessments, IFRS 16 lease term assessments (no material impact on lease term assessment), the annual impairment review and the going concern and viability assessments. New and amended accounting standards that have been issued but are not yet effective At the date of authorisation of these Financial Statements, the following standards and interpretations were in issue but have not been applied in these Financial Statements as they were not yet mandatory: • IFRS 17 ‘Insurance Contracts’ • ‘Classification of Liabilities as Current or Non-Current’ (Amendments to IAS 1) • Interest Rate Benchmark Reform (Amendments to IFRS 9, IAS 39 and IFRS 7) • Amendments to IAS 37 ‘Onerous Contracts – Cost of Fulfilling a Contract’ • Conceptual Framework – ‘Amendments to References to the Conceptual Framework in IFRS Standards’ • Amendments to IAS 16 ‘Property, Plant and Equipment – Proceeds Before Intended Use’ • Annual Improvements to IFRS Standards 2018–2020 Cycle – Amendments to IFRS 1 ‘First-time Adoption of International Financial Reporting Standards’, IFRS 9 ‘Financial Instruments’, IFRS 16 ‘Leases’, and IAS 41 ‘Agriculture’ These IFRSs are not expected to have a material impact on the Group’s consolidated financial position or performance of the Group. Application of significant new or amended EU-endorsed accounting standards The following amended standards and interpretations were also effective during the year; however, they have not had a material impact on our consolidated Financial Statements. • Amendments to IFRS 3 ‘Definition of a Business’ • Amendments to IAS 1 and IAS 8 ‘Definition of Material’ • Covid-19 Related Rent Concessions – Amendment to IFRS 16 Application of IFRIC agenda decisions In April 2021, the IFRS Interpretations Committee (IFRIC) published an agenda decision on the clarification of accounting in relation to the configuration and customisation costs incurred in implementing Software-as-a-Service (SaaS) as follows: • Amounts paid to the cloud vendor for configuration and customisation that are not distinct from access to the cloud software are expensed over the SaaS contract term • In limited circumstances, other configuration and customisation costs incurred in implementing SaaS arrangements may give rise to an identifiable intangible asset, for example, where code is created that is controlled by the entity • In all other instances, configuration and customisation costs will be expensed as the customisation and configuration services are received See Notes 12 and 34 for further details. Basis of measurement The consolidated Financial Statements have been prepared on the historical cost basis except for consideration payable on acquisitions, the revaluation of certain financial instruments and investments. Functional and presentation currency The Group and Company Financial Statements are presented in millions of Pounds Sterling (£m) because that is the currency of the principal economic environment in which the Group operates. 140 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 1 Accounting policies continued Going concern The Directors have acknowledged guidance published in relation to going concern assessments. The Group’s business activities, together with the factors likely to affect its future development, performance and position, are set out in the Business Review and Financial Review. The Group’s financial position, cash and borrowing facilities are also described within these sections. The Financial Statements have been prepared on a going concern basis which the Directors consider to be appropriate for the following reasons. The Directors have prepared cash flow and covenant compliance forecasts for the 12 month period ending September 2022 which indicate that, taking account of severe but plausible downsides and the anticipated impact of Covid-19 on the operations of the Group and its financial resources, the Group and Company will have sufficient funds to meet their liabilities as they fall due for that period. The Group is financed primarily by a £100m committed revolving credit facility which matures in June 2024. The Group is required to comply with financial covenants for leverage (net debt to Adjusted EBITDA 1) and interest cover (Adjusted EBITDA 1 to interest charge) which are tested bi-annually at 31 May and 30 November each year. As at 31 May 2021, the Group had drawn down £33.8m for working capital requirements. Subsequent to the year end and shareholder approval on 1 June, the Group acquired on 7 June the IPM business for $220m; the US acquisition was funded through an equity placing in May of £70.2m (net proceeds) combined with a new three year $70m term loan, existing cash balances and our existing revolving credit facility. The impact of the acquisition on the Group’s financial performance, covenants and business model has therefore been considered within this going concern assessment. As at 2 June 2021, following the acquisition of the IPM business, the Group had drawn down £75.5m of its revolving credit facility and was due to incur further transaction costs of £6.4m. As at 31 August 2021, cash, net debt (excluding lease liabilities) 1 and headroom amounted to £43.6m, £74.7m and £80.5m respectively. Although the Group has demonstrated resilience to the challenging environment resulting from Covid-19, the Directors acknowledge that the financial performance of the Group has been adversely impacted to certain degree since the commencement of the pandemic, and for this reason the base case forecast for 2021 reflects this assessment. The continuing macro-economic risks and potential changes in government policies (on the severity of enforced lockdowns worldwide) could have a continued effect on the Group’s performance. However, trading throughout the pandemic has demonstrated resilience. The Directors have prepared a number of severe but plausible scenarios as follows: 1. 2. The performance of FY22 continues to be similar to that of 2021, including the impact on regional and international operations of the Group and a potential reduction in growth. An additional impact of Covid-19 during a two month period from January to February 2022 which coincides with a similar economic pandemic pattern as 2021. 3. Potential impact of customers’ inability to pay during a specified period. 4. 5. Failure of execution of the strategy, loss of key customers and a number of acquisition related risks crystallising (for example increased customer churn, integration and cash collection issues). Software Resilience performance does not return to growth and the Assurance business experiences similar impact of Covid-19 on its performance as 2021. These scenarios have been modelled individually and also in combination in order to assess the Group’s ability to withstand multiple challenges, although the Directors do not believe a scenario combining all these risks to be plausible. The impact of these sensitivities has been reviewed against the Group’s projected cash flow position, available bank facilities and compliance with financial covenants. In the instance that a combination of the above scenarios arise, mitigating actions would be required to ensure that the Group remains liquid and financially viable, which might include a reduction of planned capital expenditure, freezing pay and recruitment and not paying a dividend to shareholders. All of the mitigating actions are within the Directors’ control. These forecasts, including the severe but plausible downsides, show that the Group is able to operate within its available banking facilities, with no forecasted covenant breaches, and that the Group will have sufficient funds to meets its liabilities as they fall due for that period. From a Company perspective, the Company places reliance on other Group trading entities for financial support. Having reviewed the current trading performance, forecasts, other Group trading entities’ financial support, debt servicing requirements, total facilities and risks, the Directors are confident that the Company and the Group will have sufficient funds to continue to meet their liabilities as they fall due for a period of at least 12 months from the date of approval of these Financial Statements. Accordingly, they continue to adopt the going concern basis of accounting in preparing the Group’s Financial Statements for the year ended 31 May 2021. Business combinations Business combinations are accounted for by applying the acquisition method at the acquisition date, which is the date on which control is transferred to the Group. The Group controls an entity when the Group is exposed to, or has rights to, variable returns from its involvement with the entity and has the ability to affect those returns through its power over the entity. Acquisitions The Group measures goodwill at the acquisition date as: • The fair value of the consideration transferred; plus • The recognised amount of any non-controlling interests in the acquiree; plus • If the business combination is achieved in stages, the fair value of the existing equity interest in the acquiree; less • The fair value of the identifiable assets acquired and liabilities assumed. When the excess is negative, a bargain purchase gain is recognised immediately in profit or loss. The consideration transferred does not include amounts related to the settlement of pre-existing relationships. Such amounts generally are recognised in the Income Statement. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 141 Financial statements1 Accounting policies continued Acquisitions continued Costs related to the acquisition, other than those associated with the issue of debt or equity securities, are expensed as incurred. Any deferred or contingent consideration payable is recognised at fair value at the acquisition date. If the contingent consideration is classified as equity, it is not remeasured and settlement is accounted for within equity. Otherwise, subsequent changes to the fair value of contingent consideration are recognised in the Income Statement. On a transaction-by-transaction basis, the Group elects to measure non-controlling interests either at their fair value or at their proportionate interest in the recognised amount of the identifiable net assets of the acquiree at the acquisition date. Subsidiaries Subsidiaries are entities controlled by the Group. The Financial Statements of subsidiaries are included in the consolidated Financial Statements from the date that control commences until the date that control ceases. Control is achieved where the Company has the power to govern the financial and operating policies of an investee entity so as to obtain benefits from its activities. Intercompany transactions and balances between subsidiaries are eliminated on consolidation. Intangible assets and goodwill Goodwill represents amounts arising on acquisition of subsidiaries. In respect of business acquisitions that have occurred since 1 June 2004, goodwill represents the difference between the cost of the acquisition and the fair value of the net identifiable assets acquired including identifiable intangible assets. Identifiable intangibles are those which can be sold separately or which arise from legal rights regardless of whether those rights are separable. In respect of acquisitions prior to 1 June 2004, goodwill is included at its deemed cost, which represents the amount recorded under UK GAAP at 31 May 2004 which was broadly comparable, save that only separable intangibles were recognised and goodwill was amortised. Goodwill is stated at cost less any accumulated impairment losses. Goodwill is allocated to cash generating units and is not amortised but is tested annually for impairment. In respect of equity accounted investees, the carrying amount of goodwill is included in the carrying amount of the investment in the investee. Research and development Expenditure on research activities is recognised in the Income Statement as an expense as incurred. Expenditure on development activities is capitalised as “development costs” if the product or process is technically and commercially feasible, if the Group has the technical ability and sufficient resources to complete development, if future economic benefits are probable and if the Group can measure reliably the expenditure attributable to the intangible asset during its development. Development activities involve a plan or design for the production of new or substantially improved products or processes. Software costs The Group capitalises “software costs” in accordance with the criteria of IAS 38. Software costs comprise third party costs and internal employee time costs for internal system developments. Capitalised amounts are initially measured at cost and amortised on a straight-line basis over the period for which the developed system is expected to be in use as a business platform. Software costs incurred as part of a service agreement are only capitalised when it can be evidenced that the Group has control over the resources defined in the arrangement. The expenditure capitalised includes the cost of materials, direct labour, overhead costs that are directly attributable to preparing the asset for its intended use and capitalised borrowing costs. Other development expenditure is recognised in the Income Statement as an expense as incurred. Software customisation and configuration costs relating to software not controlled by the Group are expensed over the period such services are received. Software costs are stated at cost less accumulated amortisation and less accumulated impairment losses. Intangible assets Expenditure on internally generated goodwill is recognised in the Income Statement as an expense as incurred. Intangible assets that are acquired by the Group are stated at cost less accumulated amortisation and less accumulated impairment losses. Subsequent expenditure Subsequent expenditure is capitalised only when it increases the future economic benefits embodied in the specific asset to which it relates. All other expenditure, including expenditure on internally generated goodwill, is recognised in the Income Statement as an expense as incurred. Amortisation Amortisation is charged to the Income Statement on a straight-line basis over the estimated useful economic lives of intangible assets unless such lives are indefinite. Intangible assets with an indefinite useful life and goodwill are systematically tested for impairment at each Balance Sheet date. Intangible assets are amortised from the date they are available for use. The estimated useful lives are as follows: Acquired customer contracts and relationships – between three and ten years Software Capitalised development costs – between three and five years – between three and five years Financial instruments Financial assets and financial liabilities, in respect of financial instruments, are recognised in the Group Balance Sheet when the Group becomes a party to the contractual provisions of the instrument. Classification and measurement of financial assets and liabilities Classification of financial assets is generally based on the business model in which the financial asset is managed and its contractual cash flow characteristics. A financial asset is measured at amortised cost if it is held with the objective of collecting the contractual cash flows and its contractual terms give rise on specified dates to cash flows that are solely payments of principal and interest on the principal amount outstanding. All other financial assets are measured at fair value through other comprehensive income or the Income Statement. 142 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 2021 1 Accounting policies continued Financial assets at amortised cost Trade and other receivables Trade receivables and other receivables that have fixed or determinable payments that are not quoted in an active market are classified as financial assets measured at amortised cost. Under the IFRS 9 “expected credit loss” model, a credit event (or impairment “trigger”) no longer needs to occur before credit losses are recognised. The Group analyses the risk profile of trade receivables based on past experience and an analysis of the receivables’ current financial position, potential for a default event to occur, adjusted for specific factors, general economic conditions of the industry in which the receivables operate and assessment of both the current and the forecast direction of conditions at the reporting date. A default event is considered to occur when information is obtained that indicates that a receivable is unlikely to be paid to the Group. Credit risk is regularly reviewed by management to ensure the expected credit loss (ECL) model is being appropriately applied. The Group has performed the calculation of ECL separately for each business unit. Financial liabilities at amortised cost Trade payables Trade payables are other financial liabilities initially measured at fair value and subsequently measured at amortised cost. Impairment of non-financial assets The carrying amounts of the Group’s non-financial assets, other than deferred tax assets, are reviewed at each reporting date to determine whether there is any indication of impairment. If any such indication exists, then the asset’s recoverable amount is estimated. For goodwill, and intangible assets that have indefinite useful lives or that are not yet available for use, the recoverable amount is estimated each year at the same time. The recoverable amount of an asset or cash generating unit is the greater of its value in use and its fair value less costs to sell. In assessing value in use, the estimated future cash flows are discounted to their present value using a pre-tax discount rate that reflects current market assessments of the time value of money and the risks specific to the asset. For the purpose of impairment testing, assets that cannot be tested individually are grouped together into the smallest group of assets that generates cash inflows from continuing use that are largely independent of the cash inflows of other assets or groups of assets (the ‘cash generating unit’). The goodwill acquired in a business combination, for the purpose of impairment testing, is allocated to cash generating units (CGUs). Subject to an operating segment ceiling test, for the purposes of goodwill impairment testing, CGUs to which goodwill has been allocated are aggregated so that the level at which impairment is tested reflects the lowest level at which goodwill is monitored for internal reporting purposes. Goodwill acquired in a business combination is allocated to groups of CGUs that are expected to benefit from the synergies of the combination. An impairment loss is recognised if the carrying amount of an asset or its CGU exceeds its estimated recoverable amount. Impairment losses are recognised in the Income Statement. Impairment losses recognised in respect of CGUs are allocated first to reduce the carrying amount of any goodwill allocated to the units, and then to reduce the carrying amounts of the other assets in the unit (group of units) on a pro rata basis. An impairment loss in respect of goodwill is not reversed. In respect of other assets, impairment losses recognised in prior periods are assessed at each reporting date for any indications that the loss has decreased or no longer exists. An impairment loss is reversed if there has been a change in the estimates used to determine the recoverable amount. An impairment loss is reversed only to the extent that the asset’s carrying amount does not exceed the carrying amount that would have been determined, net of depreciation or amortisation, if no impairment loss had been recognised. Related party transactions Details of related party transactions are set out in Note 32 to these Financial Statements. Property, plant and equipment Property, plant and equipment assets are carried at cost less accumulated depreciation and any recognised impairment in value. To the extent that borrowing costs relate to the acquisition, construction or production of a qualifying asset, borrowing costs are capitalised as part of the cost of that asset. Depreciation is charged to the Income Statement on a straight-line basis over the estimated useful economic lives of each part of an item of plant and equipment as follows: Computer equipment – between three and five years Plant and equipment – between three and five years Furniture – between three and five years Fixtures and fittings Motor vehicles – five years – four years Property, plant and equipment is also tested for impairment whenever there is an indication of potential impairment. Leases At inception of a contract, the Group assesses whether a contract is, or contains, a lease. A contract is, or contains, a lease if the contract conveys the right to control the use of an identified asset for a period of time in exchange for consideration. To assess whether a contract conveys the right to control the use of an identified asset, the Group assesses whether: • The contract involves use of the identified asset; this may be specified explicitly or implicitly and should be physically distinct or represent substantially all of the capacity or a physically distinct asset. If the supplier has a substantive substitution right, then the asset is not identified • The Group has the right to obtain substantially all of the economic benefits from use of the asset and throughout the period of use NCC Group plc — Annual report and accounts for the year ended 31 May 2021 143 Financial statements 1 Accounting policies continued Leases continued • The Group has the right to direct the use of the asset. The Group has this right when it has the decision-making rights that are most relevant to changing how and for what purpose the asset is used. In rare cases where all the decisions about how and for what purpose the asset is used are predetermined, the Group has the right to direct the use of the asset if either: • The Group has the right to operate the asset • The Group designed the asset in a way that predetermines how and for what purpose it will be used The Group recognises a right-of-use asset and a lease liability at the lease commencement date. The right-of-use asset is initially measured at cost, which comprises the initial amount of the lease liability adjusted for any lease payments made at or before the commencement date, and an estimate of costs to dismantle and remove the underlying asset or to restore the underlying asset or the site on which it is located, less any lease incentives received. The right-of-use asset is subsequently depreciated using the straight-line method from the commencement date to the earlier of the end of the useful life of the right-of-use asset or the end of lease term. The estimated useful lives of right-of-use assets are determined on the same basis as those of property, plant and equipment. In addition, the right-of-use asset is periodically reduced by impairment losses, if any, and adjusted for certain remeasurements of the lease liability. The lease liability is initially measured at the present value of the lease payments that are not paid at the commencement date, discounted using the interest rate implicit in the lease or, if that rate cannot be readily determined, the Group’s incremental borrowing rate. The lease liability is measured at amortised cost using the effective interest method. It is remeasured when there is a change in future lease payments arising from a change in an index or rate, if there is a change in the Group’s estimate of the amount expected to be payable, or if the Group changes its assessment of whether it will exercise a purchase, extension or termination option. When the lease liability is remeasured in this way, a corresponding adjustment is made to the carrying amount of the right-of-use asset, or is recorded in the Income Statement if the carrying amount of the right-of-use asset has been reduced to zero. The Group has elected not to recognise right-of-use assets and lease liabilities for short-term leases that have a lease term of 12 months or less and leases of low value assets, including certain IT equipment. The Group recognises the lease payments associated with these leases as an expense on a straight-line basis over the lease term. Lease rental costs in respect of short-term leases (less than one year) and low value assets which are exempt from being accounted for under IFRS 16 are charged to the Income Statement on a straight-line basis over the period of the lease. Investments Investments in subsidiaries are carried at cost less impairment. Investments in property and unlisted shares are carried at cost less impairment, which is based on the fair value at acquisition. Inventory Inventory is held at the lower of cost or net realisable value. Revenue recognition Summary The Group provides independent global cyber assurance security and Software Resilience services. The revenue streams in relation to Assurance include: • Global Professional Services (GPS) – global cyber security consultancy services • Global Managed Services (GMS) – operational cyber defence, incident response, scanning, simulation and managed security operations centres (SOCs) • Product sales – sale of own manufactured and/or resale of third party products The revenue streams in relation to Software Resilience include: • Escrow contract services – securely maintain in “escrow” the long-term availability of business critical software and applications • Verification services – verify source code, and provide a fully managed secure service and result validation While the detailed recognition is contract specific, and set out in the table on pages 145 to 148, in most cases: • GPS revenues are recognised on an input method over time • GMS revenues are bifurcated according to the separate performance obligations (see pages 146 and 147) • Product sales are recognised when control passes, usually on delivery • Escrow contract revenues are recognised over time • Verification services are recognised on the completion of the verification service Revenue is presented net of VAT and other sales related taxes. Revenue is measured based on the consideration specified in a contract with a customer. The Group recognises revenue when it transfers control over a good or service to a customer. 144 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 20211 Accounting policies continued Revenue recognition continued Summary continued Due to the nature of the Group’s activities, the Group transaction price for the majority of its contracts is entirely variable consideration as these contracts are on a time and material basis, using set contractual rates per hour/day worked, giving rise to no estimation or reversal risk at period end. The Group does not have any material obligations in respect of returns, refunds or warranties. The impact of any financing component within contracts with customers has been assessed and concluded to be immaterial. On contract inception, the probability of collectability is assessed across the Group and, unless there is a significant change in facts and circumstances, revenue is recognised. During the year, no instances have been identified where reassessment of the collectability has had to be reassessed, nor have there been any new contracts with customers for which the collection of consideration has not been assessed at inception as probable. This current year assessment also takes into account the impact of Covid-19 on the Group’s customer base. Detailed policies The following table provides information about the nature and timing of the satisfaction of performance obligations in contracts with customers by reportable segments, including significant payment terms, and the related revenue recognition policies. Assurance Revenue stream Nature Timing of satisfaction of performance obligations and significant payment terms Revenue recognition policies, including determination of transaction price and rationale Global Professional Services (GPS) GPS is the Group’s core consulting service represented by consultants providing cyber security consultancy services to a customer over time or to a set deliverable. Some contracts may contain multiple services (e.g. cyber security assessment and certified product evaluation services). These will be identified as separate performance obligations, and the transaction price allocated to each of these is determined by using the fixed contract rate based upon day rates, being the relative standalone selling price basis. Specifically, the contract terms range from time and materials (based upon consultants’ time and expenses) and discrete statements of work, whereby the customer benefits gradually over the period over which the work is performed, unless there is a set deliverable (for example a defined security assessment report). The Group in certain situations operates on agreed customer terms which allow the Group to recover any abortive revenue from its customer in the event that a customer terminates a contract before the contract or deliverable is complete. The customer simultaneously receives the benefits of the consulting services provided by the Group over the period over which the work is performed and one promise (performance obligation) is identified. Work is performed on a daily basis. Invoices are raised monthly or based on an agreed invoicing profile with the customer. Invoices are usually payable within 30 days. No discounts or retrospective rebates are provided. Where a set deliverable is required and the customer receives the incremental benefit at the end of the work when the deliverable is transferred to the customer, this represents one performance obligation. In this situation, the contract will have no abortive revenue rights; therefore, the Group has no right to consideration for performance to date. Invoicing will usually be on completion of the set deliverable and payable within 30 days. The customer simultaneously receives and consumes the benefits of the consulting services provided by the Group over the period over which the work is performed by the Group and one performance obligation is identified. Invoices in relation to the abortive revenue will be recognised when aborted. Invoices are usually payable within 30 days. Revenue is recognised on an input basis to measure the satisfaction of performance obligations over time. This is done according to the number of days worked in comparison to the total contracted number of days of the performance obligation. The work performed occurs on a daily basis (for example security assessment of a customer’s security environment). It is considered that as the customer benefits over time based on consultants’ time, the input method faithfully depicts the Group’s performance towards complete satisfaction of the single performance obligation. Transaction price is determined by fixed contract rates based upon day rates and number of days. Revenue is recognised at a point in time, on completion of the performance obligation deliverable. It is considered that as the customer benefits once the set deliverable is received, the point in time method faithfully depicts the Group’s performance towards complete satisfaction of the single performance obligation. Transaction price is determined by fixed contract rates. Revenue is recognised on an input basis to measure the satisfaction of performance obligations over time. This is done according to the number of days worked in comparison to the total contracted number of days of the performance obligation. Transaction price is determined by fixed contract rates based upon day rates and number of consultancy days. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 145 Financial statements1 Accounting policies continued Assurance continued Revenue stream Nature Global Managed Services (GMS) These services provide operational cyber defence, incident response, scanning, simulation and managed security operations centres (SOCs). Services are typically for an extended delivery duration, with contract lengths varying up to a maximum of five years. The proposition will also provide the customer with software licence(s) to enable these services to occur. On this basis, the Group operates two types of contracts: • A Managed Service Provider (MSP) model whereby the customer is supplied with one complete integrated service including the software licence(s) • A reseller model whereby the Group sources the software licence(s) on behalf of the customer and provides the Managed Detection and Response services These services will also include set-up fees. Set-up fees represent workshops, design, and configuration to create a “connection” between systems. Following services going live, the Group will also provide a certain level of professional service consultancy days based on a day rate (post-go-live fees). Timing of satisfaction of performance obligations and significant payment terms Revenue recognition policies, including determination of transaction price and rationale The customer will benefit from the services over the period of the contract. The amount of revenue recognised in relation to software licence(s) depends on whether the Group acts as an agent or as a principal. However, the type of contract will depend on how the customer benefits from the software licence(s). Where a MSP model is selected by the customer, the Group recognises three performance obligations: • Set-up fees • Post-go-live fees • Combined monitoring cyber and licence service The MSP model is considered to be under a principal arrangement whereby the Group controls the service prior to transfer. Where a reseller model is selected by the customer, the Group recognises four performance obligations: • Sourced software licence(s) • Set-up fees • Post-go-live fees • Monitoring cyber service The reseller model is considered to be under an agency arrangement whereby the customer receives the benefit and control of the licence on delivery. Invoices are raised monthly or based on an agreed invoicing profile with the customer. Invoices are usually payable within 30 days. The Group acts as principal when the Group controls the specified software licence or service prior to transfer (MSP model). When the Group acts as a principal the revenue recorded is the gross amount billed. The transaction price is determined by a contract price (cost plus mark-up). The transaction price for the overall service is outlined within the customer contract. In certain scenarios, the contract will outline the price for each performance obligation, which is considered to be the standalone selling price of the services/ goods, and the transaction price is allocated to each performance obligation on this basis. Where the contract does not stipulate the price per performance obligation, management determines the relative standalone selling price for each performance obligation based on a market assessment approach for the services provided in comparison to market prices, and the contract transaction price is allocated to each performance obligation in proportion to those standalone selling prices. Under a reseller model, the Group’s responsibility is to arrange for a third party to provide a specified software licence(s) to the customer. In these cases, the Group is acting as an agent and the Group does not control the relevant licence(s) before it is transferred to the customer. In particular, the Group does not have inventory risk, have access to its source code or hold the IP rights. When the Group is acting as an agent, the revenue is recorded at the net amount retained (commission) at a point in time as the customer receives immediate benefit from access to the licence and the Group does not have any further obligations in relation to the provision of the licence. The commission transaction value represents the mark-up on the licence provided. Set-up fees are recognised over time of the set-up. In particular, the level of administrative tasks involved in the set-up process is considered immaterial and therefore the work performed is considered a distinct promised service and incremental benefit of the installation to the customer. The fees are based on day rates incurred (defined by an in-house day rate sales pricing matrix). Accordingly, the charge out rates are recognised and allocated to these tasks when performed akin to technical professional day rate services. These rates are considered to be the standalone selling prices and are not discounted or reduced for other services. 146 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 20211 Accounting policies continued Assurance continued Revenue stream Nature Global Managed Services (GMS) continued Timing of satisfaction of performance obligations and significant payment terms Revenue recognition policies, including determination of transaction price and rationale Post-go-live fees are recognised on delivery of consultancy services over time as the customer obtains incremental benefit from the hours provided. Revenue is recognised on an input basis (day rates) to measure the satisfaction of performance obligations over time. Transaction price is determined by fixed contract rates based upon day rates and number of post-go-live consultancy days. One performance obligation, being a combined monitoring cyber and licence service, is identified in relation to the MSP model monitoring service. Revenue is recognised over the contract length as the software and monitoring process is an overall service, whereby the Group retains control of the licence and provides a complete monitoring service to the customer. If the customer cancels the contract, the Group will retain control of the licence. The customer benefits from a 24/7 monitoring service whereby benefit is obtained daily and therefore revenue is recognised on straight-line basis as the performance obligation is satisfied over time. The transaction price is determined by fixed contract rates for the combined services. Revenue in relation to the reseller model monitoring service is recognised over the contract length on a straight-line basis as the performance obligation is satisfied over time. The customer benefits from a 24/7 monitoring service whereby benefit is obtained daily on straight-line basis. Revenue is recognised when control of the product is transferred to the customer. This occurs upon delivery under the contractual terms. On certain sales of third party products, the control of the product is considered to pass from the vendor to the end customer and in these cases the Group acts as an agent, and hence only records a commission on sale as opposed to gross revenue and costs of sale. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 147 Product sales This revenue represents the sale of own manufactured and/or resale of third party products with no connection to other Group services. The customer only benefits from the products on delivery. Invoices are raised monthly or based on an agreed invoicing profile with the customer. Invoices are usually payable within 30 days. Financial statements1 Accounting policies continued Assurance continued Revenue stream Nature Long-term fixed price contracts This revenue represents the long-term development and/or manufacture of specialised software and hardware solutions. Timing of satisfaction of performance obligations and significant payment terms Revenue recognition policies, including determination of transaction price and rationale Revenue is recognised on an input basis to measure the satisfaction of the performance obligation over time. This is done according to total costs incurred in comparison to the total expected costs to be incurred to satisfy the performance obligation. This input measure is driven by the nature of the activities carried out in satisfying the performance obligation. The transaction price is fixed within the terms of the contractual arrangement. Delivery of the product is considered to represent one performance obligation. The development and/or manufacturing work carried out by the Group is not considered to create an asset with an alternative use to the entity. The Group is entitled to payment as performance of the contract is completed. On this basis, revenue is recognised over time. Invoices are raised based on achievements of pre-defined milestones in the contract. Invoices are usually payable within 30 days. Software Resilience Escrow contract services These services securely maintain in “escrow” the long-term availability of business critical software and applications while protecting the intellectual property rights (IPR) of technology partners. The service will include set-up time which is administrative in nature. The customer benefits from the escrow service evenly over a contract period, usually at least a year and potentially up to three years. The service represents one performance obligation. Invoices are raised based on an agreed invoicing profile with the customer. Invoices are usually payable within 30 days. Revenue is recognised over time on a straight- line basis representing the service delivery agreement. The nature of the agreement gives rise to the customer having the benefit of software resilience if and when required over the contract period. Revenue is recognised on a straight-line basis as the pattern of benefit to the customer as well as the Group’s efforts to fulfil the contract are generally even throughout the period. The transaction price is determined by a contract price. Set-up time is not considered distinct and a separate performance obligation due to the administrative nature and therefore is recognised over the period of the contract. Verification services These services verify source code based upon an agreed scope between all parties, and provide a fully managed secure service and result validation, typically delivered over a short period of time (days). These include SaaS services and ICANN services. The customer benefits from the verification service on completion because the source code will only have been fully verified/validated at that point. Revenue is recognised on completion of the verification services. Transaction price is determined by fixed contract rates based upon day rates and number of verification days. The service represents one performance obligation. Invoices are raised monthly or based on an agreed invoicing profile with the customer. Invoices are usually payable within 30 days. Contract costs Contract costs comprise incremental sales commissions paid to sales agents which can be directly attributed to an acquired or retained contract. Capitalised commission costs are amortised on a systematic basis that is consistent with the transfer to the customer of the services when the related revenues are recognised. In all other cases, all internal and external costs of obtaining the contract are recognised as incurred. Costs directly incurred in fulfilling a contract with a customer, which comprise labour hours on long-term contracts, are recognised as an asset to the extent they are recoverable. Such costs are amortised on a systematic basis that is consistent with the transfer to the customer of the services when the related revenues are recognised. 148 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 20211 Accounting policies continued Accrued income Accrued income represents the Group’s rights to consideration for work completed but not billed at the reporting date. Remaining balances are transferred to receivables when the rights become unconditional. Deferred revenue Deferred revenue represents advanced consideration received from customers, for which revenue is recognised over time. Long-term loss-making contracts Long-term contracts are reviewed annually to establish if the contract is onerous in nature. In particular, the long-term contract becomes an onerous contract when the unavoidable costs (i.e. the lower of the cost of fulfilling the contract and any compensation or penalties arising from failure to fulfil it) exceed the economic benefits expected to be received under the contract. The assessment of cost to fulfil includes costs that relate directly to the contract and includes direct costs of production, direct costs of supplies/hardware from external suppliers (materials), direct labour in relation to performance obligations and if appropriate any potential contractual fine dependent on items (performance obligations) not being delivered/performed. Any assets dedicated to the specific contract are also tested for potential impairment. Determination and presentation of operating segments The Group determines and presents operating segments based on the information that is provided to the Board, which acts as the Group’s chief operating decision maker (CODM) in order to assess performance and to allocate resources. An operating segment is a component of the Group that engages in business activities from which it may earn revenues and incur expenses, including revenues and expenses that relate to transactions with any of the Group’s other components. An operating segment’s results are reviewed regularly by the CODM to make decisions about resources to be allocated to the segment and to assess its performance. The Group reports its business in two key segments: the Assurance division and the Software Resilience division. The two reporting segments provide distinct types of service. Within each of the reporting segments the operating segments provide a homogeneous group of services. The operating segments are grouped into the reporting segments on the basis of how they are reported to the CODM. Operating segments are aggregated into the two reportable segments based on the types and delivery methods of services they provide, common management structures, and their relatively homogeneous commercial and strategic market environments. Both of the Group’s divisions (segments) are run by a senior executive team; those teams make all decisions on resource allocation, product development, marketing and areas for focus and investment. Allocation of central costs Some costs are collected and managed in one location but are actually incurred on behalf of multiple operating segments or reporting segments. These costs are then allocated to the reporting segments. The allocation is based on logical or activity driven cost algorithms. The allocation is necessary to give an accurate picture of the consumption of resources by each reporting segment. Individually Significant Items Individually Significant Items are identified as those items that based on their size and nature and/or incidence are assessed to warrant separate disclosure to provide supplementary information to support the understanding of the Group’s financial performance. Individually Significant Items typically comprise costs/profits/losses on material acquisitions/disposals/business exits, fundamental reorganisation/ restructuring programmes and other significant one-off events. Individually Significant Items are considered to require separate presentation in the notes to the Financial Statements in order to fairly present the financial performance of the Group. Foreign currencies Transactions in foreign currencies are recorded using the appropriate monthly exchange rate ruling at the date of the transaction. Monetary assets and liabilities denominated in foreign currencies are retranslated using the exchange rate ruling at the Balance Sheet date and the gains or losses on translation are included in the Income Statement. The assets and liabilities of overseas subsidiaries denominated in foreign currencies are retranslated at the exchange rate ruling at the Balance Sheet date. The income statements of overseas subsidiary undertakings are translated at the weighted average exchange rates for the financial year. Gains and losses arising on the retranslation of overseas subsidiary undertakings are taken to the currency translation reserve. They are released to the Income Statement upon disposal of the subsidiary to which they relate. Foreign currency differences arising from the translation of qualifying cash flow hedges are recognised in OCI to the extent that the hedges are effective. Derivative financial instruments and hedge accounting The Group holds derivative financial instruments to hedge its foreign currency risk exposures. Derivatives are initially measured at fair value. Subsequent to initial recognition, derivatives are measured at fair value, and changes therein are generally recognised in profit or loss. The Group designates certain derivatives as hedging instruments to hedge the variability in cash flows associated with highly probable forecast transactions arising from changes in foreign exchange rates. At inception of designated hedging relationships, the Group documents the risk management objective and strategy for undertaking the hedge. The Group also documents the economic relationship between the hedged item and the hedging instrument, including whether the changes in cash flows of the hedged item and hedging instrument are expected to offset each other. Cash flow hedges When a derivative is designated as a cash flow hedging instrument, the effective portion of changes in the fair value of the derivative is recognised in OCI and accumulated in the hedging reserve. The effective portion of changes in the fair value of the derivative that is recognised in OCI is limited to the cumulative change in fair value of the hedged item, determined on a present value basis, from inception of the hedge. Any ineffective portion of changes in the fair value of the derivative is recognised immediately in profit or loss. The Group designates only the change in fair value of the spot element of forward exchange contracts as the hedging instrument in cash flow hedging relationships. The change in fair value of the forward element of forward exchange contracts (forward points) is separately accounted for as a cost of hedging and recognised in a costs of hedging reserve within equity. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 149 Financial statements1 Accounting policies continued Cash flow hedges continued When the hedged forecast transaction subsequently results in the recognition of a non-financial item, the amount accumulated in the hedging reserve and the cost of hedging reserve is included directly in the initial cost of the non-financial item when it is recognised. For all other hedged forecast transactions, the amount accumulated in the hedging reserve and the cost of hedging reserve is reclassified to profit or loss in the same period or periods during which the hedged expected future cash flows affect profit or loss. If the hedge no longer meets the criteria for hedge accounting or the hedging instrument is sold, expires, is terminated or is exercised, then hedge accounting is discontinued prospectively. When hedge accounting for cash flow hedges is discontinued, the amount that has been accumulated in the hedging reserve remains in equity until, for a hedge of a transaction resulting in the recognition of a non-financial item, it is included in the non-financial item’s cost on its initial recognition or, for other cash flow hedges, it is reclassified to profit or loss in the same period or periods as the hedged expected future cash flows affect profit or loss. If the hedged future cash flows are no longer expected to occur, then the amounts that have been accumulated in the hedging reserve and the cost of hedging reserve are immediately reclassified to profit or loss. Employee benefits – defined contribution pensions The Group operates a defined contribution pension scheme. The assets of the scheme are kept separate from those of the Group in an independently administered fund. The amount charged as an expense in the Income Statement represents the contributions payable to the scheme in respect of the accounting period. Short-term benefits Short-term employee benefit obligations are measured on an undiscounted basis and are expensed as the related service is provided. A liability is recognised for the amount expected to be paid under short-term cash bonus or profit-sharing plans if the Group has a present legal or constructive obligation to pay this amount as a result of past service provided by the employee and the obligation can be estimated reliably. Share-based payment transactions Share-based payments in which the Group receives goods or services as consideration for its own equity instruments are accounted for as equity settled share-based payment transactions, regardless of how the equity instruments are obtained by the Group. The grant date fair value of share-based payment awards granted to employees is recognised as an employee expense, with a corresponding increase in equity, over the period that the employees become unconditionally entitled to the awards. The fair value of the options granted is measured using an option valuation model, taking into account the terms and conditions upon which the options were granted. The amount recognised as an expense is adjusted to reflect the actual number of awards for which the related service and non-market vesting conditions are expected to be met, such that the amount ultimately recognised as an expense is based on the number of awards that do meet the related service and non-market performance conditions at the vesting date. For share-based payment awards with non-vesting conditions, the grant date fair value of the share-based payment is measured to reflect such conditions and there is no true-up for differences between expected and actual outcomes. Share-based payment transactions in which the Group receives goods or services by incurring a liability to transfer cash or other assets that is based on the price of the Group’s equity instruments are accounted for as cash settled share-based payments. The fair value of the amount payable to employees is recognised as an expense, with a corresponding increase in liabilities, over the period in which the employees become unconditionally entitled to payment. The liability is remeasured at each Balance Sheet date and at settlement date. Any changes in the fair value of the liability are recognised as personnel expense within the Income Statement. Where the Company grants options over its own shares to the employees of a subsidiary it recognises in its individual Financial Statements, an increase in the cost of investment in that subsidiary equivalent to the equity settled share-based payment charge is recognised in respect of that subsidiary in its consolidated Financial Statements with the corresponding credit being recognised directly in equity. Holiday or vacation pay The Group recognises a liability in the Balance Sheet for any earned but not yet taken holiday entitlement for staff. Earned holiday is calculated on a straight-line basis over a holiday year which can vary by business unit. Taken holiday is based on actually taken holiday. Any movement in the liability between the opening and closing balance in the year is recorded as an employee cost or a reduction in employee costs in the Income Statement in the year. Borrowings Borrowings are recognised initially at fair value less attributable transaction costs. Subsequent to initial recognition, borrowings are stated at amortised cost with any difference between cost and redemption value being recognised in the Income Statement over the period of the borrowings on an effective interest basis. Finance costs Finance costs are recognised within the Income Statement in the year in which they are incurred. Provisions Provisions are determined by discounting the expected future cash flows at a pre-tax rate that reflects current market assessments of the time value of money and the risks specific to the liability. The unwinding of the discount is recognised as finance cost. 150 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 20211 Accounting policies continued Taxation Taxation on the profit or loss for the year comprises current and deferred taxation. Taxation is recognised in the Income Statement except to the extent that it relates to items recognised directly in equity, in which case it is recognised in equity. Current tax is the expected tax payable or receivable on the taxable income or loss for the year, using tax rates enacted or substantively enacted at the Balance Sheet date, and any adjustment to tax payable in respect of previous years. Deferred tax is provided on temporary differences between the carrying amounts of assets and liabilities for financial reporting purposes and the amounts used for taxation purposes. The following temporary differences are not provided for: the initial recognition of goodwill; the initial recognition of assets or liabilities that affect neither accounting nor taxable profit other than in a business combination; and differences relating to investments in subsidiaries to the extent that they will probably not reverse in the foreseeable future. The amount of deferred tax provided is based on the expected manner of realisation or settlement of the carrying amount of assets and liabilities, using tax rates enacted or substantively enacted at the Balance Sheet date. A deferred tax asset is recognised only to the extent that it is probable that future taxable profits will be available against which the temporary difference can be utilised. R&D tax credits are recognised for the UK tax jurisdiction within administrative expenses and within income tax for the US tax jurisdiction. Intra-group financial instruments Where the Company enters into financial guarantee contracts to guarantee the indebtedness of other companies within the Group, the Company considers these to be insurance arrangements and accounts for them as such. In this respect the Company treats the guarantee contract as a contingent liability until such time as it becomes probable that the Company will be required to make a payment under the guarantee. Cash and cash equivalents Cash and cash equivalents comprise cash in hand and deposits repayable on demand. Bank overdrafts that are repayable on demand form part of the Group’s cash management and are included as a component of cash and cash equivalents for the purpose only of the Statement of Cash Flows. Treasury shares NCC Group plc shares held by the Group are deducted from equity as “treasury shares” and are recognised at cost. Consideration received for the sale of such shares is also recognised in equity, with any difference between the proceeds from sale and the original cost being taken to reserves. No gain or loss is recognised in the Income Statement on the purchase, sale, issue or cancellation of equity shares. 2 Critical accounting judgements, key sources of estimation uncertainty and other estimates The preparation of Financial Statements requires management to exercise judgement in applying the Group’s accounting policies. Different judgements would have the potential to change the reported outcome of an accounting transaction or Statement of Financial Position. It also requires the use of estimates that affect the reported amounts of assets, liabilities, income and expenses. Actual results may differ from these estimates. Estimates and underlying assumptions are reviewed on an ongoing basis, with changes recognised in the period in which the estimates are revised and in any future periods affected. The table below shows those areas of critical accounting judgements and estimates that the Directors consider material and that could reasonably change significantly in the next year. Accounting area Carrying value of goodwill Control of IPM Software Resilience business Recognition of research and development tax credits Intangible assets – cloud-based software and development costs Accounting judgement? Accounting estimate? No Yes No Yes Yes No Yes No 2.1 Critical accounting judgements Information about critical accounting judgements made in applying accounting policies that have the most significant effects on the amounts recognised in the consolidated Financial Statements are as follows. Control of IPM Software Resilience business A key judgement in the year ended 31 May 2021 is the acquisition date for the purchase of the IPM Software Resilience business. Management considers shareholder approval of the transaction constitutes a change in control and therefore the date of shareholder approval is considered to be the acquisition date for the transaction. Shareholder approval was granted on 1 June 2021 and the IPM Software Resilience business will be consolidated into the Group results from that date. Intangible assets – cloud-based software and development costs When the Group incurs customisation and configuration costs, as part of a service agreement, judgement is also required in assessing whether the Group has control over the resources defined in the arrangement. Management has considered the IFRS Interpretations Committee (IFRIC) agenda decision in April 2021 on the clarification of accounting in relation to these costs. The costs expensed amount to £5.1m (2020: £7.9m). See further details in Notes 12 and 34 in relation to a prior year restatement. Development activities involve a plan or design for the production of new or substantially improved products or processes. Judgement is required in determining whether the project is technically and commercially feasible; judgement is required in assessing the future economic benefit and viability of the project. Such judgements are inherently subjective and can have a material impact on determining whether such costs should be capitalised. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 151 Financial statements2 Critical accounting judgements, key sources of estimation uncertainty and other estimates continued 2.2 Estimation uncertainties Information about estimation uncertainties that have a significant risk of resulting in a material adjustment to the carrying values of assets and liabilities within the next financial year is addressed below. Whilst every effort is made to ensure that such estimates and assumptions are reasonable, by their nature they are uncertain, and as such changes in estimates and assumptions may have a material impact. Estimates and assumptions used in the preparation of the Financial Statements are continually reviewed and revised as necessary at each reporting date. Carrying values of goodwill The Group has significant balances relating to goodwill at 31 May 2021 as a result of acquisitions of businesses in previous years. The carrying value of goodwill at 31 May 2021 is £182.9m (2020: £193.1m). Goodwill balances are tested annually for impairment. Tests for impairment are primarily based on the calculation of a value in use for each CGU. This involves the preparation of discounted cash flow projections, which require significant estimates of both future operating cash flows and an appropriate risk-adjusted discount rate. The commercial viability of individually capitalised development project costs is also part of the overall assessment of carrying values. Future cash flow estimates are based on two critical estimates: the rate of revenue growth and the discount rate, particularly in relation to the Europe Assurance CGU which is the most sensitive to movements in estimates. The calculation of an appropriate discount rate to apply to the future cash flow estimate is itself an estimate. While some aspects of discount rate calculations can be more mechanical in nature (such as using the 30 year gilt yield as a proxy for the risk free rate) others, such as entity or sector-specific risk adjustments, rely more on management estimates. The discount rate is also a key component in assessing the terminal value which is often an important part of any valuation. Sensitivity analysis on what are regarded as reasonably possible changes is provided in Note 12. Recognition of research and development tax credits The tax expense reported for the current year and prior year is affected by certain positions taken by management where there may be uncertainty. The most significant source of uncertainty arises from claims for US research and development (R&D) tax credits relating to historical periods. Uncertainty arises as a result of a degree of uncertainty concerning the interpretation of US legislation and because the statute of limitations has not expired. The basis on which the Group has claimed R&D tax credits involves a technical assessment of which party bears the economic risk in any research contracts entered into with third parties. This assessment is a key estimate. It is considered “probable” that the US taxation authority would accept the uncertain tax treatment in relation to the utilised tax credits recognised. For the periods ending 31 May 2017 to 31 May 2021, the aggregate net current tax benefit included in the Income Statement relating to the R&D US tax credits is £2.7m (2020: £4.3m). The gross deferred tax asset relating to the R&D US tax credits is £1.0m (2020: £0.8m), although due to the uncertainty we have made a provision of £0.6m (2020: £0.8m) against this asset. The aggregate gross amount of US R&D tax credits recognised amounts to £8.2m (2020: £5.1m) and we have made a provision of £5.1m (2020: £0.8m) against this gross position. It is considered reasonably possible that the outcome relating to historical claims ranges from a potential increase of tax credits of £5.1m to a potential reduction of £3.1m. 2.3 Other estimates Long-term loss-making contracts Some aspects of the Group’s revenue are derived from relatively long-term fixed price contracts. On this basis, estimation uncertainty is disclosed in relation to one contract: • An onerous provision recognised during the year ended 31 May 2020 of £0.2m has increased during the period by a further £1.9m, of which £1.7m has been utilised leaving a closing balance of £0.4m of a total provision for loss-making contracts of £1.1m (see Note 21). This additional provision relates to a European contract and has been caused by Covid-19 disruption and some project management challenges. Management prepares projections, which, due to the complexity of the contract, require estimates and accounting judgement of both revenue and cost recognition (including the number of performance obligations). Revenue is recognised based on the input method of IFRS 15 in relation to total costs and therefore management has to estimate the number of hours still required to complete the long-term projects and associated labour cost to complete. Due to the level of estimation and dependency on hours remaining to complete the performance obligation, sensitivity analysis on what is regarded a reasonably possible scenario for this contract is provided below: • A 20% increase in total labour hours to the project would give rise to a further provision of up to £0.2m 3 Alternative Performance Measures (APMs) and adjusting items The consolidated Financial Statements include APMs as well as statutory measures. These APMs used by the Group are not defined terms under IFRS and may therefore not be comparable with similarly titled measures reported by other companies. They are not intended to be a substitute for, or superior to, Generally Accepted Accounting Practice (GAAP) measures. All APMs relate to the current year results and comparative periods where provided. This presentation is also consistent with the way that financial performance is measured by management and reported to the Board, and the basis of financial measures for senior management’s compensation schemes, and provides supplementary information that assists the user in understanding the financial performance, position and trends of the Group. At all times, the Group aims to ensure that the Annual Report and Accounts give a fair, balanced and understandable view of the Group’s performance, cash flows and financial position. IAS 1 ‘Presentation of Financial Statements’ requires the separate presentation of items that are material in nature or scale in order to allow the user of the accounts to understand underlying business performance. 152 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 20213 Alternative Performance Measures (APMs) and adjusting items continued As discussed in the prior year Annual Report and in accordance with FRC guidelines, the Group no longer presents a Consolidated Income Statement showing adjusting items separately. In the prior year, the Group disclosed adjusting items of £10.2m relating to amortisation of acquisition intangibles (2020: £8.8m) and share-based payments (2020: £1.4m) as a separate column on the face of the Consolidated Income Statement. This is no longer disclosed in this way to simplify the Group’s results. However, as the Group manages internally its performance at an adjusted operating profit level (before amortisation of acquisition intangibles, share-based payments and Individually Significant Items), which management believes better represents the underlying trading of the business, this information is still disclosed as an APM within this Annual Report. This APM is reconciled to statutory operating profit, together with the consequently Adjusted basic EPS (before amortisation of acquisition intangibles, share-based payments and Individually Significant Items and tax effect thereon) to statutory basic EPS. This change has removed the following adjusted measures from the Group’s narrative reporting and disclosures: • Adjusted profit before taxation • Adjusted taxation Following this revision to APMs, the Group has the following APMs/non-statutory measures: • Adjusted EBITDA (reconciled below) • Adjusted operating profit (reconciled below) • Adjusted basic EPS (pence) (reconciled in Note 11) • Net cash/(debt) excluding lease liabilities (reconciled below) • Net debt (reconciled below) • Cash conversion (reconciled below) • Constant currency revenue These measures provide supplementary information that assists the user to understand the financial performance, position and trends of the Group. Further detail is included within the glossary of terms to this Annual Report which provides supplementary information that assists the user in understanding theses APMs/non-statutory measures. The Group reports certain geographic regions on a constant currency basis to reflect the underlying performance taking into account constant foreign exchange rates year on year. This involves translating comparative numbers to current year rates for comparability to enable a growth factor to be calculated. In addition, the Group also reports these regions on a local currency basis to demonstrate the revenue performance on a local basis. As these measures are not statutory revenue numbers, management consider these to be APMs. Adjusted EBITDA and Adjusted operating profit The calculation of Adjusted EBITDA and Adjusted operating profit is set out below: Operating profit Depreciation of property, plant and equipment Depreciation of right-of-use assets Amortisation of customer contracts and relationships (acquired intangibles) Amortisation of software and development costs Individually Significant Items (Note 5) Share-based payments charge (Note 26) Adjusted EBITDA Depreciation and amortisation (excluding amortisation charged on acquired intangibles) Adjusted operating profit 2021 £m 17.3 4.4 5.9 6.4 3.0 12.7 2.8 52.5 (13.3) 39.2 2020 (restated) 2 £m 12.6 5.8 6.0 8.8 3.0 7.9 1.4 45.5 (14.8) 30.7 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 153 Financial statements3 Alternative Performance Measures (APMs) and adjusting items continued Net cash/(debt) The calculation of net cash/(debt) is set out below: Cash and cash equivalents (Note 24) Borrowings (Note 24) Net cash/(debt) excluding lease liabilities Lease liabilities Net cash/(debt) Cash conversion ratio The calculation of the cash conversion ratio is set out below: Cash generated from operating activities before interest and taxation (A) Adjusted EBITDA (B) Cash conversion ratio (%) (A)/(B) 2021 £m 116.5 (33.2) 83.3 (34.4) 48.9 2020 £m 95.0 (99.2) (4.2) (38.2) (42.4) 2021 £m 46.3 52.5 2020 (restated) 2 £m 46.8 45.5 88.2% 102.9% 4 Segmental information The Group is organised into the following two (2020: two) reportable segments: Assurance and Software Resilience. The two reporting segments provide distinct types of service. Within each of the reporting segments the operating segments provide a homogeneous group of services. The operating segments are grouped into the reporting segments on the basis of how they are reported to the chief operating decision maker (CODM) for the purposes of IFRS 8 ‘Operating Segments’, which is considered to be the Board of Directors of NCC Group plc. Operating segments are aggregated into the two reportable segments based on the types and delivery methods of services they provide, common management structures, and their relatively homogeneous commercial and strategic market environments. Performance is measured based on reporting segment profit, which comprises Adjusted operating profit 1 and adjusting items are not allocated to business segments.. Interest and tax are also not allocated to business segments and there are no intra-segment sales. Segmental analysis 2021 Revenue Cost of sales Gross profit Gross margin % General administrative expenses allocated Adjusted EBITDA 1 Depreciation and amortisation Adjusted operating profit 1 Individually Significant Items (Note 5) Amortisation of acquired intangibles Share-based payments Operating profit Assurance £m Software Resilience £m Central and head office £m 233.9 (149.5) 84.4 36.1% (45.4) 39.0 (9.4) 29.6 – – – 36.6 (10.4) 26.2 71.6% (9.5) 16.7 (0.7) 16.0 – – – 29.6 16.0 – – – – (3.2) (3.2) (3.2) (6.4) (12.7) (6.4) (2.8) (28.3) Group £m 270.5 (159.9) 110.6 40.9% (58.1) 52.5 (13.3) 39.2 (12.7) (6.4) (2.8) 17.3 154 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 20214 Segmental information continued Segmental analysis 2020 (restated) 2 Revenue Cost of sales Gross profit Gross margin % General administrative expenses allocated Adjusted EBITDA 1 Depreciation and amortisation Adjusted operating profit 1 Individually Significant Items (Note 5) Amortisation of acquired intangibles Share-based payments Operating profit Segmental analysis 2021 Additions to non-current assets Reportable segment assets Reportable segment liabilities Segmental analysis 2020 (restated) 2 Additions to non-current assets Reportable segment assets Reportable segment liabilities Assurance £m Software Resilience £m Central and head office £m 226.2 (149.3) 76.9 34.0% (43.9) 33.0 (10.7) 22.3 – – – 37.5 (10.0) 27.5 73.3% (10.0) 17.5 (0.6) 16.9 – – – – – – – (5.0) (5.0) (3.5) (8.5) (7.9) (8.8) (1.4) 22.3 16.9 (26.6) Assurance £m Software Resilience £m Central and head office £m 6.0 69.3 (94.9) – 13.5 (4.5) 2.1 349.5 (66.7) Assurance £m 4.7 88.0 Software Resilience £m Central and head office £m 0.2 18.4 12.3 330.8 Group £m 263.7 (159.3) 104.4 39.6% (58.9) 45.5 (14.8) 30.7 (7.9) (8.8) (1.4) 12.6 Group £m 8.1 432.3 (166.1) Group £m 17.2 437.2 (73.9) (14.5) (142.9) (231.3) The Central and head office cost centre is not considered to be a separate operating segment nor part of any other operating segment as it does not generate any revenues. Included within Central and head office are assets and liabilities not specifically allocated to the reporting segments and include investments, head office tangible and intangible assets, deferred tax assets and liabilities, right-of-use assets and associated lease liabilities, Parent Company cash balances, the RCF facility and certain provisions. Central and head office assets and liabilities are disclosed to allow a reconciliation back to the Group’s assets and liabilities. During the year, management has amended its segment disclosure to reflect the way the performance of the business is reported to the CODM and managed. The performance of the APAC region was previously included within Europe and APAC. For the year ended 31 May 2021, the APAC region is now included together with the UK segment until it becomes such a size that warrants separate reporting to the CODM. In addition, with the continuing growth and formation of a European division we have changed geographical segments in line with how this information is reported to the Board and managed today and have represented prior year figures on a like-for-like basis. The net book value of non-current assets is analysed geographically as follows: UK and APAC North America Europe Total non-current assets 2021 £m 172.0 60.5 9.0 241.5 2020 (restated) 2 £m 188.3 68.6 10.4 267.3 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 155 Financial statements4 Segmental information continued Revenue is disaggregated by primary geographical market, by category and timing of revenue recognition as follows: Revenue by originating country UK and APAC North America Europe Total revenue Revenue by category Services Products Total revenue Timing of revenue recognition Services and products transferred over time Services and products transferred at a point in time Total revenue Assurance £m Software Resilience £m 102.7 82.7 48.5 233.9 25.2 7.3 4.1 36.6 Assurance £m Software Resilience £m 228.3 5.6 233.9 47.9 186.0 233.9 36.6 – 36.6 24.0 12.6 36.6 2021 Total £m 127.9 90.0 52.6 270.5 2021 Total £m 264.9 5.6 270.5 71.9 198.6 270.5 Assurance £m Software Resilience £m 98.8 82.4 45.0 226.2 25.9 7.8 3.8 37.5 Assurance £m Software Resilience £m 215.7 10.5 226.2 41.4 184.8 226.2 37.5 – 37.5 25.7 11.8 37.5 2020 Total £m 124.7 90.2 48.8 263.7 2020 Total £m 253.2 10.5 263.7 67.1 196.6 263.7 There are no customer contracts in either 2021 or 2020 which account for more than 10% of segment revenue. 5 Individually Significant Items The Group separately identifies items as Individually Significant Items. Each of these is considered by the Directors to be sufficiently unusual in terms of nature or scale so as not to form part of the underlying performance of the business. They are therefore separately identified and excluded from adjusted results (as explained in Note 3). Individually Significant Items (ISIs) Cloud configuration and customisation costs Costs directly attributable to the acquisition of the IPM Software Resilience business Total ISIs 2021 £m 5.1 7.6 12.7 2020 (restated) 2 £m 7.9 – 7.9 Cloud configuration and customisation costs These costs relate to the material spend previously capitalised in relation to the Group’s Securing Growth Together digital transformation programme that have now been expensed following the adoption of the IFRIC agenda decision. The costs meet the Group’s policy for ISIs. See Note 34 for further details in relation to the prior year restatement. Costs directly attributable to the acquisition of the IPM Software Resilience business These costs are directly attributable to the material acquisition of the IPM Software Resilience business (see Note 35) and are therefore considered to meet the Group’s policy for ISIs. The nature of the costs includes legal, accountancy, due diligence and other advisory services. 156 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 20216 Expenses and auditor’s remuneration Continuing activities Profit before taxation is stated after charging/(crediting): Amounts receivable by auditor and its associates in respect of: Audit of these Financial Statements Audit of Financial Statements of subsidiaries pursuant to legislation Total audit 4 Amortisation of development costs (Note 12) Amortisation of software costs (after the adoption of the IFRIC agenda decision on cloud configuration and customisation costs) (Note 12) Amortisation of acquired intangibles (Note 12) Depreciation of property, plant and equipment (Note 13) Depreciation of right-of-use assets (Note 14) Impairment of right-of-use assets (Note 14) Costs directly attributable to the acquisition of the IPM Software Resilience business (included within ISIs) (Note 5) Cloud configuration and customisation costs (Note 5) Credit losses recognised on financial assets Cost of inventories recognised as an expense Foreign exchange losses Lease rental costs charged: – Hire of property, plant and equipment 5 Research and development expenditure Profit on disposal of intangible assets Profit on disposal of right-of-use assets Loss on sale of property, plant and equipment 2021 £m 2020 (restated) 2 £m 0.7 0.1 0.8 2.0 1.0 6.4 4.4 5.9 – 7.6 5.1 0.8 1.1 1.5 0.1 0.5 (0.5) (0.2) 0.2 0.4 0.1 0.5 2.0 1.0 8.8 5.8 6.0 1.1 – 7.9 0.7 0.5 – 0.5 0.6 – (0.1) – 4 The only non-audit service provided by the auditor was for the interim review at 30 November 2020, for which the fee was £75,000 (2020: £50,000). 5 The charge to the Income Statement in respect of lease rental costs relates entirely to short-term leases for which the Group has taken the exemption allowed from applying the principles of IFRS 16. 7 Staff numbers and costs Directors’ emoluments are disclosed in the Remuneration Committee Report. Total aggregate emoluments of the Directors in respect of 2021 were £2.2m (2020: £1.6m). Employer contributions to pensions for Executive Directors for qualifying periods were £nil (2020: £50,000). The Company provided pension payments in lieu of pension contributions for two Executive Directors during the year ended 31 May 2021 amounting to £50,000. The aggregate net value of share awards granted to the Directors in the period was £0.7m (2020: £0.7m). The net value has been calculated by reference to the closing mid-market price of the Company’s shares on the day before the date of grant. During the year, 104,526 share options were exercised by Directors (2020: nil) and their gain on exercise of share options was £88,000 (2020: £nil). The average monthly number of persons employed by the Group during the year, including Directors, is analysed by category as follows: Operational Administration Total The aggregate payroll costs of these persons were as follows: Wages and salaries Share-based payments (Note 26) Social security costs Other pension costs (Note 31) Total payroll costs Number of employees 2021 1,523 374 1,897 2020 1,518 355 1,873 2021 £m 2020 £m 152.5 148.4 2.8 13.7 5.3 1.4 14.7 5.6 174.3 170.1 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 157 Financial statements8 Finance costs Interest payable on bank loans and overdrafts Interest expense on lease liabilities Finance costs The above finance costs relate entirely to liabilities not at fair value through profit or loss. 9 Taxation Recognised in the Income Statement Current tax expense Current year Adjustment to tax expense in respect of prior periods Impact of prior year US R&D tax credits Foreign tax Total current tax Deferred tax expense Origination and reversal of temporary differences Movement in tax rate Recognition of previously unrecognised deductible timing differences Impact of prior year US R&D tax credits Adjustment to tax expense in respect of prior periods Total deferred tax Tax expense on continuing operations Reconciliation of effective tax rate Profit before taxation Current tax using the UK corporation tax rate of 19% (2020: 19%) Effects of: Items not (assessable)/deductible for tax purposes Adjustment to tax charge in respect of prior periods Impact of prior year US R&D tax credits Impact of current year US R&D tax credits Differences between overseas tax rates Movements in temporary differences not recognised Movement in tax rate Total tax expense 2021 £m 1.3 1.2 2.5 2021 £m (0.8) (0.4) 2.7 4.3 5.8 (0.7) 0.4 – (0.8) 0.1 (1.0) 4.8 2021 £m 14.8 2.8 (0.5) (0.3) 1.9 (0.3) 0.7 0.1 0.4 4.8 2020 £m 1.8 1.2 3.0 2020 (restated) 2 £m 2.0 (0.6) – 4.4 5.8 (2.7) (0.3) (0.4) 0.5 0.3 (2.6) 3.2 2020 (restated) 2 £m 9.6 1.8 0.9 (0.3) 0.5 – 0.9 (0.3) (0.3) 3.2 Current and deferred tax recognised directly in equity was a credit of £0.3m (2020: £nil). In the March 2021 budget the UK government announced that legislation will be introduced in the Finance Bill 2021 to increase the main rate of UK corporation tax from 19% to 25%, effective 1 April 2023. This rate was substantively enacted on 24 May 2021 and therefore the deferred tax balances as at 31 May 2021 are generally measured at a rate of 25%. 158 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 2021 9 Taxation continued Application of IFRIC agenda decisions During the year, the Group has reviewed its accounting policy to align with IFRIC guidance issued in April 2021 in relation to Software-as-a-Service (SaaS) costs previously capitalised; following this review certain costs previously capitalised in relation to cloud-based arrangements have been expensed and amortisation charged on those assets has been reversed. This had the impact on the UK tax charge in the prior year of £1.2m. See Note 34 for further details on this prior year restatement. Tax uncertainties The tax expense reported for the current year and prior year is affected by certain positions taken by management where there may be uncertainty. The most significant source of uncertainty arises from claims for US R&D tax credits relating to historical periods. Uncertainty arises as a result of a degree of uncertainty concerning interpretation of US legislation and because the statute of limitations has not expired. For the periods ending 31 May 2017 to 31 May 2021, the aggregate net current tax benefit to the Income Statement relating to the US R&D tax credits is £2.7m (2020: £4.3m). The gross deferred tax asset relating to the US R&D tax credits is £1.0m (2020: £0.8m), although due to the uncertainty we have made a partial provision of £0.6m (2020: £0.8m) against this asset. The aggregate gross amount of US R&D tax credits recognised amounts to £8.2m (2020: £5.1m) and we have made a provision of £5.1m (2020: £0.8m) against this gross position. 10 Dividends Dividends paid and recognised in the year Dividends per share paid and recognised in the year Dividends per share proposed but not recognised in the year 2021 £m 13.0 4.65p 3.15p 2020 £m 12.9 4.65p 3.15p The proposed final dividend for the year ended 31 May 2021 of 3.15p per ordinary share on approximately 309.8m ordinary shares (approximately £10m) was approved by the Board on 14 September 2021 and will be recommended to shareholders at the AGM on 4 November 2021. The dividend has not been included as a liability as at 31 May 2021. The payment of this dividend will not have any tax consequences for the Group. 11 Earnings per ordinary share Earnings per ordinary share are shown on a statutory and an adjusted basis to assist in the understanding of the performance of the Group. Statutory earnings (A) Basic weighted average number of shares in issue (C) Dilutive effect of share options Diluted weighted average shares in issue (D) 2021 £m 10.0 Number of shares m 281.2 1.5 282.7 2020 (restated) 2 £m 6.4 Number of shares m 278.0 2.5 280.5 For the purposes of calculating the dilutive effect of share options, the average market value is based on quoted market prices for the period during which the options are outstanding. Earnings per ordinary share Basic (A/C) Diluted (A/D) 2021 Pence 3.6 3.5 2020 (restated) 2 Pence 2.3 2.3 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 159 Financial statements11 Earnings per ordinary share continued Adjusted basic EPS 1 is reconciled as follows: Statutory earnings (A) Amortisation of acquired intangibles Share-based payments Individually Significant Items (see Note 5) Tax effect of above items Adjusted earnings (B) Adjusted earnings per ordinary share Basic (B/C) Diluted (B/D) 12 Goodwill and intangible assets Cost At 1 June 2019 – restated 2 Additions – restated 2 Transfers Disposals Effects of movements in exchange rates At 31 May 2020 – restated 2 Additions Disposals Effects of movements in exchange rates At 31 May 2021 Accumulated amortisation At 1 June 2019 – restated 2 Charge for year – restated 2 Disposals Effects of movements in exchange rates At 31 May 2020 – restated 2 Charge for year Disposals Effects of movements in exchange rates At 31 May 2021 Net book value At 31 May 2021 At 31 May 2020 – restated 2 2021 £m 10.0 6.4 2.8 12.7 (5.1) 26.8 2021 Pence 9.5 9.5 Goodwill £m Software £m Development costs £m Customer contracts and relationships £m Intangibles subtotal £m 2020 (restated) 2 £m 6.4 8.8 1.4 7.9 (3.4) 21.1 2020 (restated) 2 Pence 7.6 7.5 Total £m 255.6 – – – 3.7 259.3 – (10.2) (10.2) 20.7 1.0 0.2 (9.1) – 12.8 1.7 – – 238.9 14.5 (66.2) – – – (66.2) – 10.2 – (18.9) (1.0) 9.1 – (10.8) (1.0) – – (56.0) (11.8) 182.9 193.1 2.7 2.0 12.7 1.3 (0.2) (2.3) – 11.5 0.6 – (0.4) 11.7 (7.5) (2.0) 2.3 (0.1) (7.3) (2.0) – 0.3 (9.0) 2.7 4.2 87.1 120.5 376.1 – – – 1.1 88.2 – (13.0) (2.1) 2.3 – 2.3 – (11.4) (11.4) 1.1 4.8 112.5 371.8 2.3 (13.0) (2.5) 2.3 (23.2) (12.7) 73.1 99.3 338.2 (55.8) (8.8) – (0.8) (82.2) (11.8) 11.4 (0.9) (148.4) (11.8) 11.4 (0.9) (65.4) (83.5) (149.7) (6.4) 13.0 1.3 (9.4) 13.0 1.6 (9.4) 23.2 1.6 (57.5) (78.3) (134.3) 15.6 22.8 21.0 29.0 203.9 222.1 160 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 2021 12 Goodwill and intangible assets continued Development costs are capitalised in accordance with IAS 38 development criteria. For this reason, these are not regarded as realised losses. Application of IFRIC agenda decisions During the year, the Group has reviewed its accounting policy to align with IFRIC guidance issued in April 2021 in relation to Software-as-a-Service (SaaS) costs previously capitalised; following this review of costs previously capitalised for the year ended 31 May 2020 of £7.9m relating to cloud-based arrangements have now been expensed and amortisation of £1.4m charged on those assets has been reversed. Consequentially, the net impact on operating profit for the year ended 31 May 2020 is £6.5m. In addition, costs of £0.2m have been reclassified to prepayments. For the year ended 31 May 2019, the Group identified £3.6m of costs previously capitalised under cloud computing arrangements that should be expensed and £0.1m of amortisation was charged, which is to be reversed. See Note 34 for further details on this prior year restatement. Cash generating units (CGUs) Goodwill and intangible assets are allocated to CGUs in order to be assessed for potential impairment. CGUs are defined by accounting standards as the lowest level of asset groupings that generate separately identifiable cash inflows that are not dependent on other CGUs. The Directors have reviewed the continuing applicability of the judgements made in the prior year in determining the CGUs within the Group and in allocating goodwill to these CGUs. The assessment of CGUs is a key accounting judgement as set out in Note 2 of the consolidated Financial Statements. During the year, the Group revised its CGUs as follows: • On 1 June 2020, Virtual Security Research LLC (VSR) was merged into NCC Group Security Services Incorporated, which forms part of the North America Assurance CGU, and following this merger VSR no longer exists as a standalone entity. VSR continues to be included within the North America segment. From this date, the VSR business no longer generates independent cash flows since its resources are now pooled with the remainder of the US Assurance technical delivery teams and its support functions are delivered by the shared US Assurance functions. Furthermore, VSR is no longer reported separately from the rest of the US business. On the basis of the above, management has concluded that the VSR business is no longer a standalone CGU and has been subsumed into the North America Assurance CGU • During the year, the Group ceased measuring and forecasting the performance of the Payment Software Company Inc. business (PSC), which now forms part of the North America Assurance segment. On the basis of the above, management has concluded that the PSC business is no longer a standalone CGU as it is not capable of generating independent cash flows and has been subsumed into the North America Assurance CGU • During FY21, the Group has rearranged its operations so that there is now a European-wide Assurance operation, combining the Fort business unit previously included within the UK Assurance CGU and the Fox-IT business unit under a single management and reporting structure, known as Europe Assurance. As part of the integration measuring and forecasting of performance is done at the Europe Assurance level and operations such as the sales and delivery teams and support functions have been integrated such that independent cash flows are no longer identifiable below the Europe Assurance level. On this basis, management has concluded that the cash flows associated with Fox-IT and Fort should now be combined to form a single CGU The CGUs and the allocation of goodwill to those CGUs are shown below: Cash generating units UK Software Resilience North America Software Resilience Europe Software Resilience Total Software Resilience UK and APAC Assurance North America Assurance Europe Assurance Total Assurance Total Group Goodwill 2021 £m Goodwill * 2020 £m 22.9 7.5 7.2 37.6 44.2 36.4 64.7 22.9 8.7 7.5 39.1 47.3 42.4 64.3 145.3 182.9 154.0 193.1 * The prior year comparative figures have been re-presented to reflect the change in CGUs in the year described above. Impairment review Goodwill is tested for impairment annually at the level of the CGU to which it is allocated. In each of the tests carried out as at 31 May 2021, the recoverable amount of the CGUs concerned was measured on a value in use basis (VIU). VIU represents the present value of the future cash flows that are expected to be generated by the CGU to which the goodwill is allocated. Capitalised development and software costs are included in the CGU asset bases when performing the impairment review. Capitalised development projects and software intangible assets are also considered, on an asset-by-asset basis, for impairment where there are indicators of impairment. During the year, management carried out a detailed review of the capitalised product portfolio and, based on cash flow projections for the respective projects, concluded that no impairment was required. VIU calculations are an area of material management estimation as set out in Note 2 to the consolidated Financial Statements. These calculations require the use of estimates, specifically: pre-tax cash flow projections; long-term growth rates; and a pre-tax discount rate. Further detail in relation to these key assumptions used in the Group’s goodwill annual impairment review is as follows: NCC Group plc — Annual report and accounts for the year ended 31 May 2021 161 Financial statements12 Goodwill and intangible assets continued Pre-tax cash flow projections Pre-tax cash flow projections are based on the Group’s budget for the forthcoming financial year and longer-term three year strategic plans to 2024. The budget and three year strategic plan are compiled by the business unit management teams using a detailed, bottom-up process with respect to revenue, margin and overheads, taking into account factors specific to that business unit as well as wider economic factors such as industry growth expectations and the impact of Covid-19. The Group’s revenue forecasts are developed using the most reliable data available, such as the size of the existing contract base and details of confirmed orders, as well as assumptions over key operational inputs to underpin the forecast for each revenue stream. The combined effect of these individual assumptions on the overall growth rate assumed for each area of the business is then compared to management’s experience of growth and the industry’s expected growth rate. For cost forecasts, the majority of which are people related, headcount changes are forecast for delivery and sales staff in order that there are sufficient resources to support the forecasted required revenue delivery capacity as well as to deliver against sales targets, whilst also factoring in payroll inflation expectations. Overhead costs are also forecast using a bottom-up process. Forecasts go through a detailed review process and are subject to challenge at each stage of review, including by the Executive Committee. Ultimately the forecasts are approved by the Board. Assumptions have then been applied for expected revenue, margin growth, overheads and Adjusted EBITDA ¹ for the subsequent two years from the end of 2024. Adjusted EBITDA ¹ is considered a proxy for operating cash flow before changes in working capital. Pre-tax cash flow projections also include assumptions on working capital and capital expenditure requirements for each CGU. These assumptions are based on management’s experience of growth and knowledge of the industry sectors, markets and the Group’s internal opportunities for growth and margin enhancement. The projections beyond five years into perpetuity use an estimated long-term growth rate. Management has taken into account the impact of Covid-19 in formulating the above assumptions, and the underlying uncertainty of Covid-19 has been reflected in the assumptions underpinning the cash flow forecasts for each CGU rather than the pre-tax discount rates used in the impairment test. Forecast working capital and capital expenditure included within the pre-tax cash flow projections are based on management’s expectations of future expenditure required to support the Group and current run rate requirements. The revenue growth rate is considered a critical estimate by management. Revenue growth is considered to be the most critical estimate, rather than Adjusted EBITDA 1 growth which was used in the prior year, due to the Group’s relatively stable overhead base and high operating leverage. The table below summarises the cumulative average growth rate (CAGR) assumed for revenue over the five year forecast period to 2026 for each CGU: UK Software Resilience North America Software Resilience Europe Software Resilience UK and APAC Assurance North America Assurance Europe Assurance Revenue CAGR (%) 2021 Revenue CAGR (%) 2020 5.8 12.3 11.4 9.0 10.4 11.7 5.5 1.2 5.1 8.3 8.3 13.1 The revenue % growth for Europe Assurance is considered by management to be appropriate for the specific industry to which the CGU operates. Management has considered available external market data in determining the revenue growth rates over the five year forecast period. Long-term growth rates To forecast growth beyond the detailed cash flows into perpetuity, a long-term average growth rate ranging between 1.5 and 1.7% (2020: between 1.9 and 2.5%) has been used based on the specific geography of the CGU, as shown in the table below. This range represents management’s best estimate of a long-term annual growth rate aligned to an assessment of long-term GDP growth rates. A higher sector-specific growth rate would be a valid alternative estimate. A different set of assumptions may be more appropriate in future years dependent on changes in the macro-economic environment. These rates are not greater than the published International Monetary Fund average growth rates in gross domestic product for the next five year period in each relevant territory in which the CGUs operate. UK Software Resilience North America Software Resilience Europe Software Resilience UK and APAC Assurance North America Assurance Europe Assurance 162 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Growth rate (%) 2021 Growth rate (%) 2020 1.7 1.6 1.5 1.7 1.6 1.5 1.9 2.5 1.9 1.9 2.5 1.9 Notes to the Financial Statements continuedfor the year ended 31 May 202112 Goodwill and intangible assets continued Pre-tax discount rates Discount rates can change relatively quickly for reasons both inside and outside of management’s control. Those outside management’s direct control or influence include changes in the Group’s Beta, changes in risk free rates of return and changes in Equity Risk Premia. The discount rates are determined using a capital asset pricing model and reflect current market interest rates, relevant equity and size risk premiums and the risks specific to the CGU concerned. On this basis, specific discount rates are used for each CGU in the VIU calculation and the rates reflect management’s assessment on the level of relative risk in each respective CGU. The table below summarises the pre-tax discount rates used for each CGU: UK Software Resilience North America Software Resilience Europe Software Resilience UK and APAC Assurance North America Assurance Europe Assurance Pre-tax discount rate (%) 2021 Pre-tax discount rate (%) 2020 12.9 15.3 13.6 13.0 14.2 13.7 15.4 13.5 13.6 11.6 13.5 12.7 Sensitivity analysis Sensitivity analysis has been performed in respect of certain scenarios where management considers a reasonably possible change in key assumptions could occur. The following key assumptions are considered to carry the greatest level of sensitivity to forecasts: • Revenue is the primary cash flow driver (since due to the Group’s operating leverage, revenue is the key driver of Adjusted EBITDA ¹, considered as a proxy for operating cash flow before changes in working capital and capital expenditure), and a key contributor to VIU • The discount rate for each CGU: both factors inside and outside of management’s control impact the discount rate and can have a significant impact on the VIU calculation With the exception of the Europe Assurance CGU, the outcome of applying sensitivity analysis in respect of the above inputs indicated that there is no reasonably possible scenario in which the carrying value of goodwill would be considered impaired. With respect to the Europe Assurance CGU, management has considered the impact of Covid-19 on the challenging growth targets for this CGU and believes a reasonably possible change in the key assumptions of a 1.7% pts reduction in the revenue CAGR or a 1% pts increase in the discount rate would significantly reduce the headroom or give rise to an impairment. The impact of these changes in assumptions is illustrated in the table below, together with the change in each assumption that would result in the VIU falling below the carrying amount. It is noted that, whilst a 1.7% pts reduction in the revenue CAGR would give rise to a potential impairment of goodwill, it is expected that any such deterioration in expected growth rates would also lead to a reduction in expected future costs. This expected future cost reduction has not been factored into the calculations illustrated below. Sensitivity analysis £m Carrying value of assets (goodwill, development and software costs, right-of-use assets) Total VIU Surplus over carrying value of assets Assumptions used in VIU calculation: Five year CAGR Impact of reduction of 1.7% pts to five year revenue CAGR on VIU Change required in five year revenue CAGR % for VIU to fall below carrying value Pre-tax discount rate Impact of 1% pts increase in pre-tax discount rate on VIU Change required in pre-tax discount rate for VIU to fall below carrying value Impact of both 1.7% pts reduction to revenue CAGR and 1% pts increase in pre-tax discount rate on VIU Europe Assurance 31 May 2021 31 May 2020 76.9 95.1 18.2 72.9 92.3 19.4 11.7% 13.1% (43.4) 0.7% N/A 0.7% 13.7% 12.7% (7.9) 2.6% (47.6) (8.1) 2.5% N/A NCC Group plc — Annual report and accounts for the year ended 31 May 2021 163 Financial statements 13 Property, plant and equipment Cost At 1 June 2019 Additions Disposals Movement in foreign exchange rates At 31 May 2020 Additions Disposals Movement in foreign exchange rates At 31 May 2021 Depreciation At 1 June 2019 Charge for year Disposals Movement in foreign exchange rates At 31 May 2020 Charge for year Disposals Movement in foreign exchange rates At 31 May 2021 Net book value At 31 May 2020 At 31 May 2021 Computer equipment £m Fixtures, fittings and equipment £m Motor vehicles £m 19.6 21.1 2.9 (2.8) – (0.1) (0.3) 0.3 19.7 21.0 1.8 (0.1) (0.6) 0.9 (3.6) (1.0) 0.2 – (0.1) – 0.1 – – – Total £m 40.9 2.8 (3.2) 0.3 40.8 2.7 (3.7) (1.6) 20.8 17.3 0.1 38.2 (14.6) (3.0) 2.6 (0.3) (9.3) (2.8) 0.6 – (0.1) (24.0) – – – (5.8) 3.2 (0.3) (15.3) (11.5) (0.1) (26.9) (2.8) 0.2 0.4 (17.5) 4.4 3.3 (1.6) 3.3 0.7 (9.1) 9.5 8.2 – – – (4.4) 3.5 1.1 (0.1) (26.7) – – 13.9 11.5 164 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 202114 Right-of-use assets Cost At 1 June 2019 Additions Disposals At 31 May 2020 Additions Reclassifications from provisions Disposals At 31 May 2021 Depreciation At 1 June 2019 Charge for year Impairment charge At 31 May 2020 Charge for year At 31 May 2021 Net book value At 31 May 2020 At 31 May 2021 Land and buildings £m Motor vehicles £m 24.6 11.0 (2.8) 32.8 3.1 (1.4) (0.7) 33.8 – (4.9) (1.1) (6.0) (4.8) (10.8) 26.8 23.0 1.9 1.1 – 3.0 – – – 3.0 – (1.1) – (1.1) (1.1) (2.2) 1.9 0.8 Total £m 26.5 12.1 (2.8) 35.8 3.1 (1.4) (0.7) 36.8 – (6.0) (1.1) (7.1) (5.9) (13.0) 28.7 23.8 The impairment charge of £1.1m in the prior year relates to leased properties which are not currently occupied by the Group, which have been tested for impairment separately rather than within the CGU impairment tests. The impairment charge is based on the estimated recoverable amount of the right-of-use asset at the assumed date of disposal or termination of the lease, which is considered to be £nil. 15 Investments Interest in unlisted shares Group 2021 £m 0.3 Group 2020 £m 0.3 The investment in unlisted shares relates to a 3.35% ordinary shareholding in an unlisted company acquired as part of the Accumuli acquisition. The investment’s carrying value at acquisition date was considered appropriate to use as the fair value. The Directors consider there has been no change in the year. 16 Inventory Goods for resale Group 2021 £m 1.1 Group 2020 £m 0.9 The Group holds stock of certain critical components for key customers in relation to our own product sales (as opposed to third party products). The carrying value of inventory is expected to be recovered or settled within one year. There have been no write-downs of inventory in the year (2020: £nil). NCC Group plc — Annual report and accounts for the year ended 31 May 2021 165 Financial statements17 Trade and other receivables Current Trade receivables Prepayments Deferred contract costs Other receivables Contract assets – accrued income Non-current Amounts owed by Group undertakings Total Disclosed as follows: Current assets Non-current assets Group 2021 £m 35.2 8.7 – 1.9 22.9 – 68.7 68.7 – 68.7 Group 2020 (restated) 2 £m Company 2021 £m Company 2020 £m 41.6 10.8 2.1 0.9 18.0 – 73.4 73.4 – 73.4 – – – – – 162.6 162.6 – 162.6 162.6 – – – – – 142.0 142.0 – 142.0 142.0 The carrying value of trade and other receivables classified at amortised cost approximates fair value. The contract costs to fulfil represent recoverable costs relating to future performance obligations and economic benefits to the customer in relation to a long-term onerous contract (see Note 21). No impairment charge has been recognised during the year. No credit losses have been recognised in respect of amounts owed by Group undertakings (Parent Company only) in the year (2020: £nil) since they are not considered material. Amounts owed by Group undertakings in the Parent Company Balance Sheet have been disclosed as repayable after more than one year. Although these are repayable on demand, the disclosure as non-current is based on management’s expectation of the timing of repayment. The ageing of trade receivables and other receivables at the end of the reporting period was: Group Trade receivables: Not past due Past due 0–30 days Past due 31–90 days Past due more than 90 days Other receivables: Not past due Contract assets: Not past due Total The Company had no trade receivables (2020: £nil). Gross 2021 £m Expected credit losses 2021 £m Net 2021 £m 24.3 6.6 3.7 2.3 36.9 (0.1) 24.2 (0.1) (0.1) (1.4) (1.7) 6.5 3.6 0.9 35.2 Gross 2020 £m 19.6 14.4 6.5 3.6 44.1 1.9 – 1.9 0.9 23.1 61.9 (0.2) (1.9) 22.9 60.0 18.0 63.0 Expected credit losses 2020 £m – (0.1) (0.2) (2.2) (2.5) – – (2.5) Net 2020 £m 19.6 14.3 6.3 1.4 41.6 0.9 18.0 60.5 166 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 2021 17 Trade and other receivables continued The standard period for credit sales varies from 30 days to 60 days. Trade receivables which are over 30 days past due are considered to be credit impaired. The Group assesses creditworthiness of all trade debts on an ongoing basis providing for expected credit losses in line with IFRS 9. The Group has considered credit risk rating grades; these are based on the ageing categories above. Covid-19 has not had a material impact on the collection of trade receivables, and consequently has not materially impacted our forward looking estimates for expected credit losses. New customers are subject to stringent credit checks. The movement in the expected credit losses of trade and other receivables is as follows: Balance at 1 June Released/(charged) to the Income Statement Balance at 31 May Group 2021 £m (2.5) 0.8 (1.7) Group 2020 £m (1.8) (0.7) (2.5) 18 Deferred tax assets and liabilities (Group) Deferred tax assets and liabilities on the Consolidated Statement of Financial Position are offset in accordance with IAS 12. A summary of this, offset with significant jurisdictions, is shown below: Asset/(liability) Plant and equipment Short-term temporary differences IFRS 16 assets/liabilities Intangible assets Share-based payments Tax losses Deferred tax asset/(liability) Analysed as follows: Non-current assets Non-current liabilities Asset/(liability) Plant and equipment Short-term temporary differences IFRS 16 assets/liabilities Intangible assets Share-based payments Tax losses Deferred tax (liability)/asset Analysed as follows: Non-current assets Non-current liabilities UK £m 0.6 0.1 0.3 (1.7) 0.7 – – – – UK £m 0.4 0.1 0.3 (1.8) 0.2 – (0.8) – (0.8) 2021 US £m Netherlands £m Denmark £m – 4.5 0.2 (3.9) 0.7 – 1.5 1.5 – 0.3 0.2 – (1.9) 0.2 – (1.2) – (1.2) – – – – – 0.5 0.5 0.5 – 2020 (restated) 2 US £m Netherlands £m Denmark £m 0.1 6.0 0.2 (4.6) 0.2 – 1.9 1.9 – 0.4 – 0.1 (2.7) 0.1 – (2.1) – (2.1) – – – – – 0.4 0.4 0.4 – Total £m 0.9 4.8 0.5 (7.5) 1.6 0.5 0.8 2.0 (1.2) Total £m 0.9 6.1 0.6 (9.1) 0.5 0.4 (0.6) 2.3 (2.9) NCC Group plc — Annual report and accounts for the year ended 31 May 2021 167 Financial statements18 Deferred tax assets and liabilities (Group) continued Movement in deferred tax during the year: Plant and equipment Short-term temporary differences IFRS 16 assets/liabilities Intangible assets Share-based payments Tax losses Total Plant and equipment Short-term temporary differences IFRS 16 assets/liabilities Intangible assets Share-based payments Tax losses Total 1 June 2020 (restated) 2 £m 0.9 6.1 0.5 (9.0) 0.5 0.4 (0.6) 1 June 2019 (restated) 2 £m 0.4 5.1 – (10.2) 0.6 0.4 (3.7) Recognised in income £m Exchange differences £m Recognised in equity £m Adjustment to opening reserves £m 31 May 2021 £m – (0.8) – 0.8 0.9 0.1 1.0 – (0.5) – 0.7 (0.1) – 0.1 – – – – 0.3 – 0.3 – – – – – – – 0.9 4.8 0.5 (7.5) 1.6 0.5 0.8 Recognised in income £m Exchange differences £m Recognised in equity £m Adjustment to opening reserves £m 31 May 2020 £m 0.5 0.8 – 1.4 (0.1) – 2.6 – 0.2 – (0.2) – – – – – – – – – – – – 0.5 – – – 0.5 0.9 6.1 0.5 (9.0) 0.5 0.4 (0.6) The Group has recognised a deferred tax asset of £0.5m (2020: £0.4m) on tax losses as management considers it probable that future taxable profits will be available against which it can be utilised. The Group has not recognised a deferred tax asset on £25.6m (2020: £13.9m) of tax losses carried forward in the UK (£21.8m), Australia (£2.8m), North America (£0.5m) and Singapore (£0.3m) due to current uncertainties over their future recoverability (and in the case of the UK and North America because of specific legislative restrictions). A deferred tax asset of £1.0m (2020: £0.8m) in respect of R&D tax claims submitted in North America has been partially provided against due to uncertainty with regard to recoverability; an amount of £0.6m has been provided (2020: £0.8m). No deferred tax liability is recognised on temporary differences of £0.2m (2020: £0.3m) relating to the unremitted earnings of overseas subsidiaries as the Group is able to control the timing of the reversal of these temporary differences and it is probable that they will not reverse in the foreseeable future. 19 Trade and other payables Trade payables Non-trade payables Accruals Amounts owed to Group companies Total Group 2021 £m 3.3 7.9 34.0 – 45.2 Group 2020 £m 10.8 11.7 23.9 – 46.4 Company 2021 £m Company 2020 £m – – – 13.5 13.5 – – – 13.0 13.0 The carrying value of trade and other payables classified as financial liabilities measured at amortised cost approximates fair value. 168 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 202120 Lease liabilities At 1 June 2019 Additions Disposals Lease payments Interest expense At 1 June 2020 Additions Disposals Lease payments Interest expense At 31 May 2021 Analysed as follows: Current Non-current The maturity of lease liabilities is as follows: Less than one year Two to five years More than five years Total lease liabilities Land and buildings £m 33.6 9.6 (2.9) (5.4) 1.1 36.0 1.3 (0.9) (5.9) 1.1 31.6 Motor vehicles £m 2.1 1.1 – (1.1) 0.1 2.2 1.8 – (1.3) 0.1 2.8 2021 £m 5.1 29.3 2021 £m 5.1 15.8 13.5 34.4 Total £m 35.7 10.7 (2.9) (6.5) 1.2 38.2 3.1 (0.9) (7.2) 1.2 34.4 2020 £m 5.3 32.9 2020 £m 5.3 15.7 17.2 38.2 The total cash outflow for leases in the year was £7.3m (2020: £7.0m), which consists of £7.2m (2020: £6.5m) lease payments disclosed above and £0.1m (2020: £0.5m) lease payments charged to the Income Statement in respect of short-term leases. The Group has used its incremental borrowing rate of 3.3% (2020: 3.3%) as the discount rate for the calculation of the lease liabilities. Some leases contain break clauses or extension options to provide operational flexibility. Potential future undiscounted lease payments not included in the reasonably certain lease term, and hence not included in lease liabilities, total £4.0m (2020: £4.0m). NCC Group plc — Annual report and accounts for the year ended 31 May 2021 169 Financial statements21 Provisions Balance as at 31 May 2019 and 1 June 2019 Provision transferred to right-of-use assets on implementation of IFRS 16 Provisions created in the year Provisions utilised during the year Balance as at 31 May 2020 and 1 June 2020 Reclassification to right-of-use assets Reclassification Provisions created in the year Provisions utilised during the year Balance as at 31 May 2021 Analysed as follows (2021): Current Non-current Analysed as follows (2020): Current Non-current Lease incentives £m Loss-making contracts £m Onerous property costs £m Other provisions £m 4.1 (4.1) – – – – – – – – – – – – – – 0.2 – 0.2 – 1.7 1.9 (2.7) 1.1 1.1 – 0.2 – 4.1 (2.6) 2.1 (0.7) 2.9 (1.4) – 1.0 (0.8) 1.7 1.1 0.6 1.2 1.7 – – 0.6 – 0.6 – – – (0.4) 0.2 0.2 – 0.6 – Total £m 8.2 (6.7) 2.9 (0.7) 3.7 (1.4) 1.7 2.9 (3.9) 3.0 2.4 0.6 2.0 1.7 The lease incentives provision represents capital contributions towards fit-out costs and rent-free incentives. In the prior year on the implementation of IFRS 16, the opening provision of £4.1m has been transferred and offset against the associated right-of-use assets. The loss-making contracts provision represents the estimated remaining net lifetime loss on long-term development and supply contracts and is expected to be completed in 2022. During the year, revenue has been recognised in relation to this long-term contract of £1.8m. The onerous property costs provision relates to vacant premises in Reading and unused floors in the Manchester head office building. In the prior year on the implementation of IFRS 16, the opening provision of £2.6m relating to the onerous rent costs has been transferred and offset against the associated right-of-use asset. The provision of £1.7m (2020: £2.9m) at 31 May 2021 includes £1.2m (2020: £2.5m) of non-rent costs relating to the onerous properties including service charges and insurance and also the estimated costs of disposing or terminating these leases which includes rent incentives, renovation costs and letting fees. The provision at 31 May 2021 also includes estimated dilapidations liabilities of £0.5m (2020: £0.4m) relating to the Group’s leased premises. Both of these provisions are expected to unwind over the period of the relevant leases (2021–2034). Other provisions of £0.2m (2020: £0.6m) include reorganisation costs to which the Group was committed at the Balance Sheet date and are expected to be incurred within the next financial year. 170 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 202122 Contract liabilities – deferred revenue Deferred revenue represents advanced consideration received from customers, for which revenue is recognised over time. Deferred revenue is analysed as follows and is considered a contract liability: Analysed as follows: Current Non-current Group 2021 £m 43.6 0.7 44.3 Group 2020 £m 39.5 1.4 40.9 Revenue recognised in the year ended 31 May 2021 that was included in the contract liability at 1 June 2020 amounted to £39.5m (2020: £35.3m). The Group has taken advantage of the IFRS 15 practical expedient not to disclose when revenue will unwind for all contracts less than 12 months in length. The increase in deferred revenue in the year is due to the growth of the Assurance division. 23 Contract balances The following table provides information about receivables, contract assets and contract liabilities from contracts with customers. Receivables, which are included in trade and other receivables Contract assets – accrued income Contract costs – costs to obtain Contract costs – costs to fulfil an onerous contract Contract liabilities – deferred income Group 2021 £m 35.2 22.9 0.4 – Group 2020 £m 41.6 18.0 0.4 2.1 (44.3) (40.9) Note 17 17 17 17 22 Receivables represent invoiced services usually payable within 30 days whereby performance obligations have been satisfied. Accrued income represents the Group’s rights to consideration for work completed but not billed at the reporting date. Remaining balances are transferred to receivables when the rights become unconditional. Credit losses of £0.1m (2020: £nil) have been recognised in respect of contract assets. The increase in accrued income in the year is due to the growth of the Assurance division. The contract assets were not impacted by any impairment charge. The contract assets are transferred to receivables when the rights become unconditional. This usually occurs when the Group issues an invoice to the customer. Invoices usually become payable within 30 days. The contract costs to obtain of £0.4m (2020: £0.4m) represent incremental sales commissions to obtain specific contracts. The contract costs to fulfil represent recoverable costs relating to future performance obligations and economic benefits to the customer in relation to a long-term onerous contract. Contract liabilities primarily relate to advanced consideration received from customers, for which revenue is recognised over time in line with the respective performance obligation. No information is provided about remaining performance obligations at 31 May 2021 or at 31 May 2020 that have an original expected duration of one year or less, as allowed by IFRS 15. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 171 Financial statements24 Cash and cash equivalents and borrowings Cash and cash equivalents Cash and cash equivalents comprise: Cash at bank and in hand Borrowings are analysed as follows: Non-current liabilities: Revolving credit facility Total borrowings The maturity profile is as follows: Less than one year Two to five years Total borrowings Maturity 2024 Group 2021 £m 116.5 Group 2021 £m 33.2 33.2 Group 2021 £m – 33.2 33.2 Group 2020 £m 95.0 Group 2020 £m 99.2 99.2 Group 2020 £m – 99.2 99.2 Company 2021 £m 0.6 Company 2020 £m 6.8 Company 2021 £m Company 2020 £m – – – – Company 2021 £m Company 2020 £m – – – – – – In June 2019, the Group renegotiated its previous term loan and multi-currency revolving credit facilities into a new fully revolving credit facility (RCF) of £100m with a new five year term up to June 2024, on similar terms (pricing and covenants). The interest payable on drawn down funds ranges from 0.9% to 2.0% above LIBOR subject to the Group’s leverage (net debt 1 to Adjusted EBITDA ¹) ratio. Under the new arrangements, the Group can request an additional accordion facility to increase the total size of the revolving credit facility by up to £75m. The Group is required to comply with financial covenants for leverage (net debt 1 to Adjusted EBITDA 1), interest cover (Adjusted EBITDA 1 to interest charge) and provisions relating to guarantor coverage such that guarantors must exceed a prescribed threshold of the Group’s gross assets and Adjusted EBITDA 1. Covenants are tested bi-annually at 31 May and 30 November each year. Arrangement fees incurred of £1.0m are being amortised over the term. Since the new facility is on broadly similar pricing terms to the previous facility, the refinancing has been accounted for as a non-substantial modification with no gain or loss arising on modification. On 12 May 2021, the Group entered into a new Term Loan Facility Agreement. The facility made available under the Facility Agreement (the ‘Term Facility’) is a $70m amortising term loan facility, to fund the acquisition of the IPM Software Resilience business. The rate of interest on each loan under the Term Facility is the percentage rate per annum which is equal to the aggregate of a compounded rate based on the secured overnight financing rate (SOFR) administered by the Federal Reserve Bank of New York and the margin (based on a leverage ratchet varying from 1.40% to 2.65% per annum). The Term Facility is repaid in annual instalments of $23.3m on each of 10 June 2022 and 10 June 2023, with a final instalment of $23.4m payable on 10 June 2024. Arrangement fees incurred of £0.3m will be amortised over the term. The Term Facility Agreement also contains financial covenants relating to leverage and interest cover and provisions relating to guarantor coverage consistent with the RCF. The RCF is drawn in short to medium-term tranches of debt that are repayable within 12 months of draw-down. These tranches of debt can be rolled over provided certain conditions are met, including compliance with all loan terms. The Group considers that it is highly unlikely it would not be in compliance and therefore be unable to exercise its right to roll over the debt. The Directors therefore believe that the Group has the ability and the intent to roll over the drawn RCF amounts when due and consequently has presented the RCF as a non-current liability. As at 31 May 2021, the Group had committed bank facilities of £149.3m (2020: £100.0m), of which £33.8m (2020: £100.0m) had been drawn under these facilities, leaving £115.5m (2020: £nil) of undrawn facilities. Unamortised arrangement fees of £0.6m (2020: £0.8m) have been offset against the amounts drawn down, resulting in a carrying value of borrowings at 31 May 2021 of £33.2m (2020: £99.2m). The fair value of borrowings is not materially different to its amortised cost. 172 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 202125 Financial instruments Loans and borrowings Non-current Variable rate: Revolving credit facility Bank term loan Current Variable rate: Bank term loan Total loans and borrowings (excluding lease liabilities) Cash Net cash/(debt 1) (excluding lease liabilities) Non-current Lease liabilities Current Lease liabilities Net cash/(debt 1) Reconciliation of movements in liabilities to cash flows arising from financing activities Group Revolving credit facility/bank term loan: Drawdown on facility Repayment of facility Transaction costs Release of deferred arrangement fees Foreign exchange movement Movement in borrowings IFRS 16 lease liability: IFRS 16 transition adjustment New leases entered into Leases terminated Principal element of lease payments Interest element of lease payments Interest cost (non-cash) Movement in lease liabilities Group 2021 £m Group 2020 £m Company 2021 £m Company 2020 £m (33.2) (99.2) – – (33.2) (99.2) – – – – (33.2) (99.2) 116.5 83.3 95.0 (4.2) (29.3) (32.9) (5.1) 48.9 (5.3) (42.4) – – – – – – 0.6 0.6 – – 0.6 – – – – – – 6.8 6.8 – – 6.8 2021 £m 2020 £m 12.0 (72.4) – 0.2 (5.8) (66.0) – 3.1 (0.9) (6.0) (1.2) 1.2 (3.8) 44.3 – (1.0) 0.2 0.6 44.1 35.7 10.7 (2.9) (5.3) (1.2) 1.2 38.2 Financial risk management The Group has exposure to the following risks from its use of financial instruments: • Credit risk • Liquidity risk • Currency risk • Interest rate risk The Board has overall responsibility for establishing appropriate management of exposure to risk. The Audit Committee oversees how management identifies and addresses risks to the Group. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 173 Financial statements25 Financial instruments continued Capital management The Board’s policy is to maintain a strong capital base so as to maintain investor, creditor and market confidence and to sustain future development of the business. The Group monitors capital on the basis of the gearing ratio. This ratio is calculated as net cash/(debt) 1 divided by total capital. Net cash/(debt) 1 is calculated as total borrowings as shown in the Consolidated Balance Sheet, less cash and cash equivalents. Total capital is calculated as equity, as shown in the Consolidated Balance Sheet, plus net debt 1. As at 31 May 2021 the Group’s gearing ratio was (45.5)% (2020: 1.9%). Financial instruments policy All instruments utilised by the Company and Group are for financing purposes. The financial management and treasury activities of the Group are controlled centrally for all operations with local finance teams responsible for day-to-day banking activities. Fair value of financial instruments As at 31 May 2021 the Group and Company had no other financial instruments other than those disclosed below. In addition, no embedded derivatives have been identified. There have been no transfers between levels in the year. The following table presents the Group’s financial assets and liabilities that are measured at fair value by level of fair value hierarchy: • Quoted prices (unadjusted) in active markets for identical assets or liabilities (level 1) • Inputs other than quoted prices included within level 1 that are observable for the asset or liability, either directly (that is, as prices) or indirectly (that is, derived from prices) (level 2) • Inputs for the asset or liability that are not based on observable market data (unobservable inputs) (level 3) Borrowings are held at amortised cost which is considered to equate to fair value. All other assets and liabilities are held at either fair value or their carrying value which approximates to fair value. Financial assets at fair value through profit or loss Derivative financial instruments – cash flow hedge Total financial instruments Level 1 £m – – – 2021 Level 2 £m 0.3 (0.8) (0.5) Level 3 £m Level 1 £m – – – – – – 2020 Level 2 £m 0.3 – 0.3 Level 3 £m – – – Credit risk Credit risk is the risk of financial loss to the Group if a customer or counterparty to a financial instrument fails to meet its contractual obligations and arises principally from the Group’s receivables from customers. The Group’s exposure to credit risk is influenced mainly by the individual characteristics of each customer. Exposure to credit risk The carrying value of financial assets represents the maximum credit exposure. The maximum exposure to credit risk at the reporting date was: Trade receivables Other receivables Accrued income Cash and cash equivalents Total Group 2021 £m 35.2 1.9 22.9 116.5 176.5 Group 2020 £m 41.6 0.9 18.0 95.0 155.5 Company 2021 £m Company 2020 £m – – – 0.6 0.6 – – – 6.8 6.8 The maximum exposure to credit risk for trade receivables and other receivables at the reporting date by geographic region was: Debtors by geographical segment UK and APAC * North America Europe Total Group 2021 £m 17.0 11.0 9.1 37.1 Group 2020 (restated) 2 £m 21.9 13.5 7.1 42.5 Company 2021 £m Company 2020 £m – – – – – – – – * With the continuing growth and formation of a European division we have changed geographical segments in line with how this information is reported to the Board and managed on an ongoing basis and have restated prior year figures on a like-for-like basis. The APAC division was previously included within the segment Europe and APAC. 174 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 202125 Financial instruments continued Exposure to credit risk continued The maximum exposure to credit risk at the reporting date by business segment was: Debtors by business segment Assurance Software Resilience Total Group 2021 £m 30.0 7.1 37.1 Group 2020 £m 35.4 7.1 42.5 Company 2021 £m Company 2020 £m – – – – – – The trade receivables of the Group typically comprise many amounts due from a large number of customers and represent a spread of industry sectors. The largest amount due from a single customer at the reporting date represented 3.9% (2020: 9.2%) of total Group receivables. The prior year figure is considered to be exceptionally high due to a high value of sales in the latter part of the year ended 31 May 2020 which were substantially settled by cash receipts. All of the Group’s cash is held with financial institutions of high credit rating. The provisions in respect of trade receivables are used to record expected credit losses. The Group has dedicated credit control teams which regularly review customer debt balances to assess the risk of recovery. Liquidity risk Liquidity risk is the risk that the Group will not be able to meet its financial obligations as they fall due. The Group manages and minimises liquidity risk by using global cash management solutions and actively monitoring both actual and projected cash outflows to ensure that it will have sufficient liquidity to meet its liabilities when due and have headroom to provide against unforeseen obligations. In response to Covid-19, the Group has undertaken regular detailed reviews of both the potential short-term effects of the pandemic on working capital and the longer-term forecast liquidity position. Cash collections have remained strong and, though the Group took advantage of governmental tax payment deferrals during the year, these have been unwound as at 31 May 2021. Longer term, the Group has assessed its liquidity forecast as part of the viability assessment and its ability to continue trading as a going concern. For further detail on the Group’s assessment of liquidity risk refer to the Viability Statement on page 48. The following are the contractual maturities of financial liabilities, including interest payments, of the Group: At 31 May 2021 Borrowings Lease liabilities Trade and other payables At 31 May 2020 Borrowings Lease liabilities Trade and other payables Carrying amount £m Contractual cash flows £m (33.2) (34.4) (45.2) (99.2) (38.2) (46.4) (34.7) (39.6) (45.2) (104.4) (44.8) (46.4) <1 year £m (0.3) (6.3) (45.2) (1.1) (6.4) (46.4) 1–2 years £m (0.3) (5.7) – (1.1) (5.6) – 2+ years £m (34.1) (12.8) – (102.2) (13.5) – 5+ years £m – (14.8) – – (19.3) – The contractual cash flows for borrowings disclosed above relate to the Group’s RCF facility, which terminates in June 2024. The contractual cash flows include an estimate of the interest payable based on the assumption that the facility was fully drawn at £100m, and is calculated based on SONIA plus a margin of 0.9% based on the current leverage ratio. Currency risk The Group is exposed to currency risk on sales, purchases, cash and borrowings that are denominated in a currency other than the respective functional and presentational currency of the Group. The Group’s management reviews the size and probable timing of settlement of all financial assets and liabilities denominated in foreign currencies. The Group’s exposure to currency risk is as follows: Trade receivables Other receivables Cash and cash equivalents Borrowings Lease liabilities Trade and other payables Sterling £m 14.8 0.8 85.0 (30.4) (21.5) (27.3) EUR £m 9.1 – 16.1 – (2.1) (7.6) Total 21.4 15.5 2021 USD £m 10.4 0.6 7.3 (2.8) (8.6) (6.9) – Other £m 0.9 0.5 8.1 – (2.2) (3.4) 3.9 Total £m 35.2 1.9 116.5 (33.2) (34.4) (45.2) 40.8 Sterling £m 16.9 0.7 30.3 (49.9) (24.2) (20.9) (47.1) 2020 USD £m 17.6 – 40.0 (49.3) (10.6) (9.0) EUR £m 5.0 – 17.7 – (2.5) (13.2) Other £m 2.1 0.2 7.0 – (0.9) (3.3) Total £m 41.6 0.9 95.0 (99.2) (38.2) (46.4) 7.0 (11.3) 5.1 (46.3) NCC Group plc — Annual report and accounts for the year ended 31 May 2021 175 Financial statements25 Financial instruments continued Currency risk continued A change in exchange rate of 10% would have an impact of £15.2m (2020: £14.8m) on revenue, £2.7m (2020: £1.9m) on operating profit, £8.1m (2020: £7.9m) on net assets and £0.3m (2020: £4.9m) on borrowings. The Group’s risk management policy is to hedge foreign currency exposure in respect of significant material transactions that may arise from time to time. At 31 May 2021, the Group had entered into one cash flow hedge in respect of funds to be used as part of the acquisition of the IPM Software Resilience business. The Group uses forward exchange contracts to hedge its currency risk, which are short term in nature to match the maturity of the hedged item. These contracts are generally designated as cash flow hedges. The Group designates the spot element of forward foreign exchange contracts to hedge its currency risk and applies a hedge ratio of 1:1. The forward elements of forward exchange contracts are excluded from the designation of the hedging instrument and are separately accounted for as a cost of hedging, which is recognised in equity in a cost of hedging reserve. The Group’s policy is for the critical terms of the forward exchange contracts to align with the hedged item. The Group determines the existence of an economic relationship between the hedging instrument and hedged item based on the currency, amount and timing of their respective cash flows. Given the short-term nature of these hedges there is limited risk of ineffectiveness. At 31 May 2021, the Group held the following instruments to hedge exposures to changes in foreign currency rates, all of which were due to mature within one month of the Balance Sheet date. Forward exchange contracts Net exposure (£m) Average GBP:USD forward contract rate 2021 £m 70.7 1.402205 2020 £m – – Interest rate risk The Group and Company finance their operations through a combination of retained profits and bank borrowings. The Group borrows and invests surplus cash at floating rates of interest based upon bank base rate. The cash and cash equivalents of the Group and Company at the end of the financial year were as follows: Group Sterling denominated financial assets Euro denominated financial assets US Dollar denominated financial assets Other denominated financial assets Total The financial assets and liabilities of the Company at the end of the financial year were as follows: Company Financial assets Sterling denominated financial assets Amounts owed by Group undertakings Total Financial liabilities Amounts owed to Group undertakings Total 2021 £m 85.0 16.1 7.3 8.1 116.5 2020 £m 30.3 17.7 40.0 7.0 95.0 2021 £m 2020 £m 0.6 162.6 163.2 13.5 13.5 6.8 142.0 148.8 13.0 13.0 A change of 100 basis points in interest rates would result in a difference in annual pre-tax profit of £0.3m (2020: £1.0m). The Directors do not consider that the LIBOR reform will impact the Group significantly in the medium term, apart from a change in the benchmark used within the Group’s borrowing facilities. 176 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 2021 25 Financial instruments continued Interest rate risk continued The financial liabilities of the Group and their maturity profile are as follows: Less than one year Two to five years More than five years Total Sterling £m (29.5) (39.8) (10.0) (79.3) 2021 USD £m (8.3) (8.4) (1.6) EUR £m (8.4) (1.2) – Other £m (4.1) (1.5) – Total £m (50.3) (50.9) (11.6) Sterling £m (23.6) (57.9) (13.5) EUR £m (14.1) (1.5) (0.1) 2020 USD £m (10.4) (55.0) (3.5) Other £m (3.6) (0.5) (0.1) Total £m (51.7) (114.9) (17.2) (9.6) (18.3) (5.6) (112.8) (95.0) (15.7) (68.9) (4.2) (183.8) 26 Share-based payments The Company has a number of share option schemes under which options to subscribe for the Company’s shares have been granted to Directors and employees, details of which are illustrated in the tables below. Expected term of options represents the period over which the fair value calculations are based. The share-based payment charge for the year was £2.8m (2020: £1.4m) of which £2.3m (2020: £1.3m) related to equity settled payments and £0.5m (2020: £0.1m) to cash settled payments. The share-based payments charge increased during the year due to the introduction of new schemes in the year with a higher fair value than historical schemes that have reached maturity in the current year. Company Share Option (CSOP) scheme – equity settled Under the CSOP scheme, options will vest if the average EPS growth for the three years following their grant is greater than 10% per annum. Options granted in September 2019 do not have any performance criteria. Date of grant July 2012 August 2018 August 2018 September 2019 Expected term of options Exercisable between 7 years 7 years 7 years 7 years July 2015–July 2022 August 2021–August 2028 August 2021–August 2028 September 2022–September 2029 Exercise price £1.36 £2.20 £2.20 £1.79 2021 Number outstanding 58,812 49,995 18,180 363,106 Sharesave schemes – equity settled The Company operates sharesave schemes, which are available to all employees based in the UK, the Netherlands, Denmark, Spain and Australia, and full-time Executive Directors of the Company and its subsidiaries who have worked for a qualifying period. Date of grant August 2017 March 2018 August 2018 March 2019 March 2020 March 2020 May 2021 May 2021 Expected term of options Exercisable between 3 years 3 years 3 years 3 years 3 years 3 years 3 years 3 years October 2020–March 2021 May 2021–October 2021 October 2021–March 2022 May 2022–October 2022 May 2023–October 2023 May 2023–October 2023 July 2023–December 2023 July 2023–December 2023 Exercise price £1.56 £1.58 £1.75 £0.99 £1.84 £1.84 £2.15 2021 Number outstanding 17,352 4,488 372,284 290,598 641,870 324,827 194,391 £2.15 1,053,110 Employee stock purchase plan – equity settled The Company operates a stock purchase plan, which is available to all US-based employees who have worked for a qualifying period. All options are to be settled by equity. Under the scheme the following options have been granted and are outstanding at year end. Date of grant February 2020 May 2021 Expected term of options Exercisable in 1 year 1 year February 2021 May 2022 Exercise price £1.93 £2.15 2021 Number outstanding 439,735 249,580 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 177 Financial statements26 Share-based payments continued Incentive Stock Option (ISO) scheme – equity settled Under the ISO scheme, options granted will be subject to performance criteria. Options will vest if the average EPS growth for the three years following their grant is greater than 10% per annum. Date of grant August 2018 September 2019 Expected term of options Exercisable between 7 years 7 years August 2021–August 2028 September 2022–September 2029 Exercise price £2.22 £1.82 2021 Number outstanding 9,016 65,928 Long Term Investment Plan (LTIP) schemes – equity settled Options granted on or after November 2017 have three separate vesting conditions as set out below: • 60% will vest based on achieving an increase in Group EPS of 9% over three years. If growth is equal to 20% or more per annum then 100% of the award will vest. If, however, growth is less than 9% per annum, none of the award will vest. Between these two points, vesting is determined on a straight-line basis • 30% will vest based on achieving a cash conversion ratio ¹ expressed as a percentage over the measurement period of greater than 70% per annum on average. If cash conversion ¹ is greater than or equal to 80% per annum then 100% of the award will vest. If, however, cash conversion is less than 70% per annum, none of the award will vest. Between these two points, vesting is determined on a straight-line basis • 10% will vest based on the Group’s total shareholder return (TSR) ranking when measured against the FTSE 250 (excluding investment trusts). If the Group’s TSR is consistent with the median group, 20% of the award will vest; below this level, none of the award will vest. If the TSR is within the upper quartile or above, 100% of the award will vest; between the median and upper quartile, vesting is determined on a straight-line basis Date of grant August 2018 September 2019 March 2020 May 2021 Expected term of options Exercisable between 3 years 3 years 3 years 3 years June 2021–August 2021 June 2022–August 2022 June 2022–August 2022 June 2023–August 2023 Exercise price 2021 Number outstanding £nil * 860,611 £nil * 1,129,172 £nil * 194,116 £nil 682,427 * The option exercise price is £nil; however, £1 is payable on each occasion of exercise. Restricted State Unit (RSU) schemes – equity settled Options granted related to the RSU schemes on or after August 2018 have three separate vesting conditions as set out below: • 60% will vest based on achieving an increase in Group EPS of 9% over three years. If growth is equal to 20% or more per annum then 100% of the award will vest. If, however, growth is less than 9% per annum, none of the award will vest. Between these two points, vesting is determined on a straight-line basis • 30% will vest based on achieving a cash conversion ratio ¹ expressed as a percentage over the measurement period of greater than 70% per annum on average. If cash conversion ¹ is greater than or equal to 80% per annum then 100% of the award will vest. If, however, cash conversion is less than 70% per annum, none of the award will vest. Between these two points, vesting is determined on a straight-line basis • 10% will vest based on the Group’s total shareholder return (TSR) ranking when measured against the FTSE 250 (excluding investment trusts). If the Group’s TSR is consistent with the median group, 20% of the award will vest; below this level, none of the award will vest. If the TSR is within the upper quartile or above, 100% of the award will vest; between the median and upper quartile, vesting is determined on a straight-line basis The options are to be settled in equity. Date of grant August 2018 September 2019 May 2021 Expected term of options Exercisable between 3 years 3 years 3 years June 2021–August 2021 June 2022–August 2022 June 2023–August 2023 Exercise price £0.01 £0.01 £0.01 2021 Number outstanding 227,501 639,465 138,554 Restricted Share Plan (RSP) – equity settled The vesting condition for the award of RSPs relate to colleagues remaining with the Group for a certain period of time, namely two years to receive 50% of the award, and a further year to receive the remaining 50%. There are no other performance conditions. Date of grant 28 May 2021 Expected term of options Exercisable between Exercise price 2021 Number outstanding 2/3 years 50% exercisable August 2022 to August 2031, 50% exercisable August 2023 to August 2031 Nil (£0.01 in the US and Canada) 1,200,000 178 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 202126 Share-based payments continued Deferred share scheme – equity settled Date of grant September 2019 May 2021 Expected term of options Exercisable between 2 years 2 years June 2021–August 2029 August 2022–April 2031 Exercise price 2021 Number outstanding £nil * £nil 61,694 18,937 * The option exercise price is £nil; however, £1 is payable on each occasion of exercise. Phantom schemes – cash settled Phantom schemes are used to allow the grant of LTIPs to members of the Executive Committee based in certain overseas locations at a time when the Group’s option scheme rules were not structured to allow overseas grants. The vesting conditions for the award of the phantom schemes, related to options granted in August 2016, relate to growth in the Group’s EPS over the performance period. If growth is equal to 25% or more per annum then 100% of the award will vest. If, however, growth is less than 10% per annum, none of the award will vest. Between these two points, vesting is determined on a straight-line basis. Options granted in October 2017 and November 2017 have three separate vesting conditions as set out below: • 60% will vest based on achieving an increase in Group EPS of 9%. If growth is equal to 20% or more per annum then 100% of the award will vest. If, however, growth is less than 9% per annum, none of the award will vest. Between these two points, vesting is determined on a straight-line basis • 30% will vest based on achieving a cash conversion ratio ¹ expressed as a percentage over the measurement period of greater than 70% per annum on average. If cash conversion ¹ is greater than or equal to 80% per annum then 100% of the award will vest. If, however, cash conversion is less than 70% per annum, none of the award will vest. Between these two points, vesting is determined on a straight-line basis • 10% will vest based on the Group’s total shareholder return (TSR) ranking when measured against the FTSE 250 (excluding investment trusts). If the Group’s TSR is consistent with the median group 20% of the award will vest; below this level, none of the award will vest. If the TSR is within the upper quartile or above, 100% of the award will vest; between the median and upper quartile, vesting is determined on a straight-line basis Options granted in September 2019 do not have any performance criteria. Date of grant October 2017 November 2017 September 2019 Expected term of options Exercisable between 3 years 3 years 3 years June 2020–October 2021 June 2020–November 2021 September 2022–September 2023 Exercise price 2021 Number outstanding £nil * £nil * £nil * 113,120 8,189 67,036 * The option exercise price is £nil; however, £1 is payable on each occasion of exercise. Measurement of fair values The fair value of services received in return for share options is calculated with reference to the fair value of the award on the date of grant. The fair value is spread over the period during which the employee becomes unconditionally entitled to the award, adjusted to reflect actual and expected levels of vesting. Black Scholes and binomial models have been used to calculate the fair values of options on their grant date for all options issued after 7 November 2002, which had not vested by 1 January 2005. The assumptions used in the model are illustrated in the table below: Grant date Fair value at measurement date Exercise price Expected volatility Option expected term Risk free interest rate CSOP scheme July 2012–September 2019 £0.35–£0.63 £1.36–£2.20 35.0–48.0% 7 years 0.35–2.75% Sharesave scheme August 2017–May 2021 £0.67–£0.88 £0.99–£2.15 39.7–53.2% 3 years 0.50–2.20% ESPP scheme February 2020–May 2021 £0.55–£0.68 £1.93–£2.15 37.60% 1 year 0.50% ISO scheme LTIP scheme RSU scheme RSP scheme August 2018–September 2019 £0.54–£0.65 £1.82–£2.22 40.7–48.4% 7 years 0.38–1.50% November 2017–May 2021 £1.61–£2.87 £nil * 37.4–51.5% 3 years 0.21–2.00% August 2018–May 2021 £1.60–£2.87 £nil *–£0.01 47.6–51.5% 3 years 0.32–2.00% May 2021 £2.85 £nil * N/A 10 years N/A Deferred shares September 2019–May 2021 £1.84–£2.91 £nil * 40.4–55.0% 2 years 0.35–1.50% Phantom schemes October 2017–September 2019 £1.84–£2.75 £nil * 31.0–47.6% 3 years 1.81–1.96% * The option exercise price is £nil; however, £1 is payable on each occasion of exercise. The expected volatility has been based on an evaluation of the historical volatility of the Company’s share price, particularly over the historical period commensurate with the expected term. The expected term of the instruments has been based on historical experience and general option holder behaviour. For the options granted in the year ended 31 May 2021, dividend yield assumed at the time of option grant is 2.5% (2020: 2.7%). NCC Group plc — Annual report and accounts for the year ended 31 May 2021 179 Financial statements26 Share-based payments continued Reconciliation of outstanding share options The options outstanding at 31 May 2021 have an exercise price in the range of £nil to £2.22 (2020: £nil to £2.22) and a weighted average contractual life of three years (2020: three years). The following table illustrates the number and weighted average exercise prices (WAEP) of, and movements in, outstanding share awards during the year: Outstanding at 1 June Granted during the year Exercised during the year Forfeited in the year Outstanding at 31 May Exercisable at end of year Scheme CSOP schemes Sharesave/SAYE schemes ESPP schemes ISO schemes LTIP schemes RSU schemes RSP scheme Deferred shares Phantom schemes 2021 No (’000) 8,995 3,537 (1,821) (1,217) 9,494 363 2021 WAEP £0.83 £0.91 £0.88 £0.59 £0.79 £1.13 2020 No (’000) 7,326 4,438 (1,098) (1,671) 8,995 385 2020 WAEP £1.01 £0.88 £1.35 £1.39 £0.83 £0.99 Number of instruments as at 1 June 2020 543,584 Instruments granted during the year Options exercised in the year Forfeitures in the year Number of instruments as at 31 May 2021 – (22,056) (31,435) 490,093 3,363,817 1,247,501 (1,297,852) (414,546) 2,898,920 439,735 249,580 91,426 – – – – 689,315 (16,482) 74,944 3,173,813 682,427 (381,414) (608,500) 2,866,326 1,122,146 138,554 (108,945) (146,235) 1,005,520 – 1,200,000 – 72,687 188,345 18,937 (10,993) – – – 1,200,000 – – 80,631 188,345 8,995,553 3,536,999 (1,821,260) (1,217,198) 9,494,094 The liability for the cash settled share-based payments at 31 May 2021 was £0.5m (2020: £0.3m). 27 Called up share capital and reserves Allotted, called up and fully paid Ordinary shares of 1p each at the beginning of the year Ordinary shares of 1p each issued in the year Ordinary shares of 1p each at the end of the year 2021 Number of shares 2020 Number of shares 278,909,171 277,830,625 30,046,874 1,078,546 308,956,045 278,909,171 2021 £m 2.8 0.3 3.1 2020 £m 2.8 – 2.8 During the year, 2,140,474 (2020: 1,078,546) new ordinary shares of 1p were issued as a result of the exercise of share options. The proceeds of £2.4m (2020: £1.1m) were credited to the share premium account. During the year, 27,906,400 (2020: nil) new ordinary shares of 1p were issued as part of funding the acquisition of the IPM Software Resilience business. Of the gross proceeds of £72.6m, £72.3m (2020: £nil) were credited to the share premium account net of issue costs of £2.4m. See Note 35 for further details. As at 31 May 2021, no shares were held in treasury (2020: nil). Share premium The share premium account records the difference between the nominal amount of shares issued and the fair value of the consideration received. The share premium account may be used for certain purposes specified by UK law, including to write off expenses incurred on any issue of shares and to pay fully paid bonus shares. The share premium account is not distributable but may be reduced by special resolution of the Company’s ordinary shareholders and with court approval. 180 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 202127 Called up share capital and reserves continued Hedging reserve The hedging reserve comprises the effective portion of the cumulative net change in the fair value of hedging instruments used in cash flow hedges pending subsequent recognition in profit or loss or directly included in the initial cost or other carrying amount of a non-financial asset or non-financial liability. Merger reserve The merger reserve arose in 2015 from the acquisition of Accumuli plc through a share-for-share exchange in part consideration for the business. Currency translation reserve The results of overseas operations are translated at the average foreign exchange rates for the year, and their balance sheets are translated at the rates prevailing at the Balance Sheet date. Exchange differences arising on the translation of opening net assets and results of overseas operations are recognised in the currency translation reserve. All other exchange differences are included in the Income Statement. Retained earnings Retained earnings for the Group are made up of accumulated reserves. For the Company, retained earnings are made up of accumulated reserves and are considered distributable reserves. 28 Profit attributable to members of the Parent Company The profit for the year dealt with in the accounts of the Parent Company was £25.0m (2020: £6.0m). 29 Other financial commitments Non-cancellable lease rental costs are payable as follows: Within one year or less 2021 2020 Land and buildings £m – Other £m – Land and buildings £m 0.1 Other £m – The lease commitments disclosed above represent short-term (less than one year) leases only, for which the Group has taken the exemption from accounting for under IFRS 16. 30 Contingencies There are no contingent liabilities not provided for at the end of the financial year (2020: £nil). Similarly, there are no contingent assets (2020: £nil). 31 Pension scheme The Group operates a defined contribution pension scheme that is open to all eligible employees. The pension cost charge for the year represents contributions payable by the Group to the fund and amounted to £5.3m (2020: £5.6m). For the Company, the pension cost charge for the year represents contributions payable by the Company to the fund and amounted to £nil (2020: £nil). 32 Related party transactions The Group’s key management personnel comprise the Directors of the Group. Details of the remuneration paid to key management personnel are as follows: Group Salary costs (including bonus) Share-based payments Total There were no other related party transactions during the year. 2021 £m 1.8 0.4 2.2 2020 £m 1.3 0.2 1.5 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 181 Financial statements33 Investments in subsidiary undertakings Company At 1 June 2019 Increase in subsidiary investment for share-based charges At 31 May 2020 Increase in subsidiary investment for share-based charges Investment in subsidiary undertakings At 31 May 2021 Shares in Group undertakings £m 75.2 3.1 78.3 2.8 70.7 151.8 On 26 May 2021, the Company acquired 70,700,000 ordinary shares of £0.01 in NCC Group Holdings Limited for a consideration of £70,700,000. Fixed asset investments are recognised at cost. The undertakings in which the Company has a 100% interest at 31 May 2021 are as follows: Subsidiary undertakings Country of incorporation Principal activity Registered office NCC Group Holdings Limited England and Wales Holding company XYZ Building, 2 Hardman Boulevard, Spinningfields, Manchester M3 3AQ (XYZ) NCC Group (Solutions) Limited England and Wales Holding company NCC Group Corporate Limited England and Wales Corporate cost centre NCC Group Finance Limited England and Wales Financing company The National Computing Centre Limited England and Wales Dormant NCC Group Software Resilience Limited England and Wales Holding company NCC Group Software Resilience (UK) Limited England and Wales Holding company NCC Services Limited England and Wales Software Resilience and central/ head office costs NCC Group Escrow Limited England and Wales Dormant NCC Group Software Resilience (Europe) BV Netherlands Holding company NCC Group GmbH Germany Software Resilience NCC Group Escrow Europe BV Netherlands Software Resilience XYZ 1 XYZ 1 XYZ 1 XYZ 1 XYZ 1 XYZ 1 XYZ 1 XYZ 1 Van Heuven Goedhartlaan 13A, 1181LE Amstelveen, the Netherlands c/o Deloitte Legal Rechtsanwaltsgesellschaft mbH, Rosenheimer Platz 6, 81669, Munich, Bavaria, Germany Van Heuven Goedhartlaan 13A, 1181LE Amstelveen, the Netherlands NCC Group Escrow Europe (Switzerland) AG NCC Group Software Resilience (MEA-APAC) Limited NCC Group FZ-LLC Switzerland Software Resilience Ibelweg 18A, 6300 Zug, Switzerland England and Wales Holding company XYZ 1 United Arab Emirates Software Resilience Office 30, Building 16, Dubai Internet City, Dubai, UAE NCC Group Cyber Security Limited England and Wales Holding company NCC Group Cyber Security (UK) Limited England and Wales Holding company NCC Group Security Services Limited England and Wales Assurance NCC Group Audit Limited ArmstrongAdams Limited England and Wales Assurance England and Wales Assurance NCC Group Signify Solutions Limited England and Wales Assurance NCC Group Accumuli Security Limited England and Wales Assurance XYZ 1 XYZ 1 XYZ 1 XYZ 1 XYZ 1 XYZ 1 XYZ 1 182 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 2021 33 Investments in subsidiary undertakings continued Subsidiary undertakings Country of incorporation Principal activity Registered office NCC Group Cyber Security (Europe) BV Netherlands Holding company NCC Group A/S Denmark Assurance NCC Group UAB NCC Group Security Services Espana SLU Lithuania Spain Assurance Assurance Cyber Assurance Sweden AB Sweden Assurance Fox-IT Holding B.V. Netherlands Holding company Fox-IT Group B.V. Fox-IT B.V. Fox-IT Operations B.V. Fox Crypto B.V. Netherlands Netherlands Netherlands Netherlands Holding company Assurance Assurance Assurance NCC Group Cyber Security (APAC) Limited England and Wales Holding company NCC Group Pte Limited NCC Group Pty Limited Singapore Australia Assurance Assurance NCC Group Japan KK Japan Assurance Van Heuven Goedhartlaan 13A, 1181LE Amstelveen, the Netherlands 2nd Floor, Svanevej 12, DK–2400 København NV, Denmark Vilnius, Jogailos st. 9, Lithuania Calle Serrano Galvache, 56, Edificio Abedul, 4a planta, 28033 Madrid, Spain c/o Advokatfirman Delphi, P.O. Box 1432, 111 84 Stockholm Olof Palmestraat 6, 2616 LM Delft, the Netherlands (Fox-IT 3) Fox-IT 3 Fox-IT 3 Fox-IT 3 Fox-IT 3 XYZ 1 20 Collyer Quay, #19-03, Singapore (049319) Level 13, 92 Pitt Street, Sydney NSW 2000, Australia Level 18, Yesibu Garden Place Tower, 4-20-3 Ebisu Shibuya-Ku, Tokyo 650 California Street, Suite 2950, San Francisco, CA 94108, USA (North America HQ 2) NCC Group (Americas) Inc. NCC Group, LLC USA USA Holding company Software Resilience and central/head office costs North America HQ 2 NCC Group Cyber Security (Americas), LLC USA Holding company North America HQ 2 NCC Group Security Services, Inc. NCC Group Secure Registrar, Inc. NCC Group Domain Services, Inc. USA USA USA Assurance Domain services Domain services North America HQ 2 North America HQ 2 North America HQ 2 NCC Group Security Services Corporation Canada Assurance 2800 Park Place, 666 Burrard Street, Vancouver, BC V6C 2Z7, Canada Payment Software Company, Inc. USA Assurance North America HQ 2 Payment Software Company Limited England and Wales Assurance XYZ 1 NCC Group Software Resilience (Americas), LLC USA Holding company North America HQ 2 NCC Group Escrow Associates, LLC USA Software Resilience North America HQ 2 NCC Group Software Resilience (NA), LLC USA Software Resilience North America HQ 2 The undertakings in which the Company holds less than a 100% interest at the year end are as follows: Undertaking Deposit AB % interest Country of incorporation Principal activity 24% Sweden Software Resilience The Directors consider the above ownership structure and no Board representation give rise to no significant influence over the undertaking. Accordingly, the undertaking has not been consolidated. 1 2 Hardman Boulevard, Spinningfields, Manchester M3 3AQ. 2 650 California Street, Suite 2950, San Francisco, CA 94108, USA. 3 Olof Palmestraat 6, 2616 LM Delft, the Netherlands. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 183 Financial statements34 Prior year restatement In April 2021, the IFRS Interpretations Committee (IFRIC) published an agenda decision on the clarification of accounting in relation to the configuration and customisation costs incurred in implementing Software-as-a-Service (SaaS) as follows: • Amounts paid to the cloud vendor for configuration and customisation that are not distinct from access to the cloud software are expensed over the SaaS contract term • In limited circumstances, other configuration and customisation costs incurred in implementing SaaS arrangements may give rise to an identifiable intangible asset, for example, where code is created that is controlled by the entity • In all other instances, configuration and customisation costs will be expensed as the customisation and configuration services are received Due to the nature of this agenda decision and the level of spend incurred in relation to the Group’s Securing Growth Together digital transformation programme, the Group’s accounting policy in relation to such customisation and configuration costs has been reviewed and changed to align with the IFRIC guidance issued in relation to Software-as-a-Service (SaaS) costs previously capitalised. The restatement represents a non-cash adjustment. The revision to the accounting policy has been accounted for retrospectively resulting in a prior year restatement. The Group identified £17.8m additions made in the years ending 31 May 2019 and 31 May 2020 in relation to software and development costs. £7.9m of these costs capitalised for the year ended 31 May 2020 related to cloud computing arrangements that should be expensed after the consideration of the IFRIC guidance and a further £3.6m for the year ended 31 May 2019. In relation to the year ended 31 May 2020 assets, £1.4m of amortisation was charged, which is to be reversed. A further £0.2m of costs capitalised are to be reclassified to prepayments. These costs give rise to a reduction in the tax charge for the year ended 31 May 2020 of £1.2m and a corresponding increase in the Group’s deferred tax asset. The affected financial statement line items are as follows: 31 May 2020 Income Statement impact Depreciation and amortisation Individually Significant Items – expense cloud configuration and customisation costs previously capitalised Operating profit Profit before taxation Taxation Profit for the year Basic EPS Diluted EPS Balance Sheet impact Expense cloud configuration and customisation costs previously capitalised Amounts reclassified to prepayments in relation to cloud computing arrangements (restated) Reversal of amortisation on cloud configuration and customisation costs previously capitalised Other intangible assets Deferred tax assets Total non-current assets Trade and other receivables Current assets Net assets Retained earnings Total equity 184 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 31 May 2020 (previously reported) £m Restatement £m 31 May 2020 (restated) £m (25.0) – 19.1 16.1 (4.4) 11.7 4.2p 4.2p – – – 39.2 0.5 275.7 73.2 169.7 214.1 (13.8) 214.1 1.4 (7.9) (6.5) (6.5) 1.2 (5.3) (1.9p) (1.9p) (11.5) (0.2) 1.5 (10.2) 1.8 (8.4) 0.2 0.2 (8.2) (8.2) (8.2) (23.6) (7.9) 12.6 9.6 (3.2) 6.4 2.3p 2.3p (11.5) (0.2) 1.5 29.0 2.3 267.3 73.4 169.9 205.9 (22.0) 205.9 Notes to the Financial Statements continuedfor the year ended 31 May 202134 Prior year restatement continued 31 May 2020 Cash Flow Statement impact Profit for the year Amortisation of software and development costs Income tax expense Net cash generated from operating activities Software and development expenditure Net cash used in investing activities Net increase in cash and cash equivalents 31 May 2020 (previously reported) £m Restatement £m 31 May 2020 (restated) £m 11.7 4.4 4.4 47.1 (10.4) (13.2) 60.1 (5.3) (1.4) (1.2) (7.9) 7.9 7.9 – 6.4 3.0 3.2 39.2 (2.5) (5.3) 60.1 A third Balance Sheet has been presented in accordance with IAS 1 to illustrate the impact in the opening Balance Sheet for the prior financial year. The Group identified that £3.6m of costs previously capitalised under cloud computing arrangements that should be expensed and £0.1m of amortisation was charged, which is to be reversed. These additional costs give rise to a reduction in the tax charge for the year of £0.6m and a corresponding increase in the deferred tax asset. The opening Balance Sheet of the prior year has accordingly been restated to correct for these, as shown below. Balances at 1 June 2019 are those disclosed after the application of IFRS16 which was adjusted prospectively on inception. The affected financial statement line items are as follows: 1 June 2019 Balance Sheet impact Other intangible assets Deferred tax assets Total non-current assets Net assets Retained earnings Total equity 1 June 2019 (previously reported) £m Restatement £m 1 June 2019 (restated) £m 41.8 1.6 276.5 208.8 (14.0) 208.8 (3.5) 0.6 (2.9) (2.9) (2.9) (2.9) 38.3 2.2 273.6 205.9 (16.9) 205.9 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 185 Financial statements35 Post-Balance Sheet events Acquisition of IPM business On 1 June 2021, shareholder approval was passed for the acquisition of the IPM business of Iron Mountain, comprising substantially all of the assets of Iron Mountain Intellectual Property Management, Inc. together with certain other assets of affiliates of Iron Mountain exclusively related to the IPM business. The primary reasons for the business combination are to: • Scale up the Group’s core business to create a global business and platform for further growth • Generate revenue synergies through allowing the enlarged division to offer NCC’s broader suite of established verification services as well as the newer Escrow-as-a-Service (EaaS) cloud offering to the IPM business’s existing customer base • Present an exciting new opportunity to sell NCC’s cyber security services from its Assurance division into the IPM business’s broad and blue-chip customer base in the medium term • Be accretive to earnings per share from completion, even without factoring in revenue synergies • Result in greater strategic strength for the future Management considers shareholder approval of the transaction constitutes a change in control and therefore the date of shareholder approval is considered to be the acquisition date for the transaction. Shareholder approval was granted on 1 June 2021 and the IPM Software Resilience business will be consolidated into the Group results from that date (see Note 2). Details of assets acquired that are subject to provisional fair value adjustments will be reported for the year ended 31 May 2022. The acquisition for a total consideration of $220m was funded through an equity gross placing of £72.6m (see Note 27) on 17 May 2021 combined with a new three year $70m term loan (see Note 24) and the remaining $98.2m funded via existing cash balances and our revolving credit facility. The term loan was entered into on 12 May 2021 but not drawn down until 2 June 2021. Costs directly attributable to the acquisition of the IPM business totalling £7.6m have been expensed during the year (see Note 5). Issue costs of £2.4m were incurred as part of the equity placing and have been credited to the share premium account (see Note 27). 186 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Notes to the Financial Statements continuedfor the year ended 31 May 2021Glossary of terms – Alternative Performance Measures (APMs) APMs are the way that financial performance is measured by management and reported to the Board, and the basis of financial measures for senior management’s compensation schemes, and provide supplementary information that assists the user in understanding the underlying trading results. APM Closest equivalent IFRS measure Adjustments to reconcile to IFRS measure Note reference for reconciliation Definition, purpose and considerations made by the Directors Income Statement measures: Adjusted operating profit Operating profit or loss Operating profit or loss before amortisation of acquired intangibles, share-based payments and Individually Significant Items Adjusted earnings before interest, tax, depreciation and amortisation (Adjusted EBITDA) Operating profit or loss Operating profit or loss, before adjusting items, depreciation and amortisation, finance costs and taxation Adjusted basic EPS Statutory basic EPS Statutory basic EPS before amortisation of acquired intangibles, share-based payments, Individually Significant Items and the tax effect thereon 3 Represents operating profit before amortisation of acquired intangibles, share-based payments and Individually Significant Items. This measure is to allow the user to understand the Group’s underlying financial performance as measured by management, reported to the Board and used as a financial measure in senior management’s compensation schemes. The Directors consider amortisation of acquired intangibles is a non-cash accounting charge inherently linked to losses associated with historical acquisitions of businesses. The Directors consider share-based payments to be an adjusting item on the basis that fair values are volatile due to movements in share price, which may not be reflective of the underlying performance of the Group. Individually Significant Items are items that are considered unusual by nature or scale, and are of such significance that separate disclosure is relevant to understanding the Group’s financial performance and therefore requires separate presentation in the Financial Statements in order to fairly present the financial performance of the Group. 3 Represents operating profit before adjusting items, depreciation and amortisation to assist in the understanding of the Group’s performance. Adjusted EBITDA is disclosed as this is a measure widely used by various stakeholders and used by the Group to measure the cash conversion ratio. 11 Represents basic EPS before amortisation of acquired intangibles, share-based payments and Individually Significant Items. This measure is to allow the user to understand the Group’s underlying financial performance as measured by management, reported to the Board and used as a financial measure in senior management’s compensation schemes. See further details above in relation to amortisation of acquired intangibles and share-based payments. NCC Group plc — Annual report and accounts for the year ended 31 May 2021 187 Additional information Glossary of terms – Alternative Performance Measures (APMs) continued APM Closest equivalent IFRS measure Adjustments to reconcile to IFRS measure Note reference for reconciliation Definition, purpose and considerations made by the Directors Balance Sheet measure: Net cash/(debt) excluding lease liabilities Total borrowings (excluding lease liabilities) offset by cash and cash equivalents Net cash/(debt) Total borrowings (including lease liabilities) offset by cash and cash equivalents Cash flow measure: Cash conversion ratio Ratio % of net cash flow from operating activities before interest and tax divided by operating profit Ratio % of net cash flow from operating activities before interest and tax divided by EBITDA 3 3 3 Represents total borrowings (excluding lease liabilities) offset by cash and cash equivalents. It is a useful measure of the progress in generating cash, strengthening of the Group Balance Sheet position, overall net indebtedness and gearing on a like-for-like basis. Net cash/(debt), when compared to available borrowing facilities, also gives an indication of available financial resources to fund potential future business investment decisions and/or potential acquisitions. Represents total borrowings (including lease liabilities) offset by cash and cash equivalents. It is a useful measure of the progress in generating cash, strengthening of the Group Balance Sheet position, overall net indebtedness and gearing including lease liabilities. Net cash/(debt), when compared to available borrowing facilities, also gives an indication of available financial resources to fund potential future business investment decisions and/or potential acquisitions. The cash conversion ratio is a measure of how effectively operating profit is converted into cash and effectively highlights both non-cash accounting items within operating profit and also movements in working capital. It is calculated as net cash flow from operating activities before interest and taxation (as disclosed on the face of the Cash Flow Statement) divided by EBITDA for continued and discontinued activities. The cash conversion ratio is a measure widely used by various stakeholders and hence is disclosed to show the quality of cash generation and also to allow comparison to other similar companies. Constant currency and local currency revenue measures: The Group also reports certain geographic regions on a constant currency basis to reflect the underlying performance taking into account constant foreign exchange rates year on year. This involves translating comparative numbers to current year rates for comparability to enable a growth factor to be calculated. In addition, the Group also reports these regions on a local currency basis to demonstrate the revenue performance on a local basis. As these measures are not statutory revenue numbers, management considers these to be APMs. 188 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Glossary of terms – other terms Other terms Code Adjusted Adjusted earnings Definition and usage Guidance, issued by the Financial Reporting Council in 2016 and updated in 2018, on how companies should be governed, applicable to UK-listed companies including NCC Group plc. Any result described as adjusted excludes the impact of Individually Significant Items, and any tax on any of these items. Adjusted earnings is defined as statutory earnings before amortisation of acquisition intangibles, Individually Significant Items and the share-based payments charge, net of the tax effect of these items. Adjusted operating profit margin 1 Calculated as Adjusted operating profit divided by revenue from continuing activities. AGM Annual General Meeting of shareholders of the Company held each year to consider ordinary and special business as provided in the Notice of AGM. Alternative Performance Measure (APM) An Alternative Performance Measure (which is denoted in each case or use thereof by a footnote) is a non-GAAP performance metric used by management either internally or externally to present management’s view of the underlying business performance. They are not superior to GAAP-based measures and are simply an alternative way of looking at performance. See Note 3 for further information. Board The Board of Directors of the Company (for more information see pages 74 and 75). Cash conversion ratio 1 Calculated as cash generated from operating activities before interest and taxation divided by Adjusted EBITDA 1, expressed as a percentage. CDO CEO CFO CISO Cyber Defence Operations. Chief Executive Officer. Chief Financial Officer. Chief Information Security Officer. Company, Group, NCC, we, our or us We use these terms, depending on the context, to refer to either NCC Group plc, the individual Company, or to NCC Group plc and its subsidiaries collectively. CPO CTO Chief People Officer. Chief Technology Officer. Directors/Executive Directors/ Non-Executive Directors The Directors/Executive Directors and Non-Executive Directors of the Company whose names are set out on pages 74 and 75 of this report. EBIT EBIT margin % EBITDA Earnings before interest and tax. EBIT margin % is calculated as follows: Adjusted EBIT divided by revenue. Earnings before interest, tax, depreciation and amortisation. Calculated as operating profit before Individually Significant Items and adding back depreciation and amortisation charged. EBITDA margin % EBITDA divided by revenue. EPS FCA Financial year FRC Free cash flow FRS Earnings per share. Profit for the year attributable to equity shareholders of the Parent allocated to each ordinary share. Financial Conduct Authority. For NCC Group this is an accounting year ending on 31 May. Financial Reporting Council. Net cash from operating activities less net capital expenditure. A UK Financial Reporting Standard as issued by the UK Financial Reporting Council (FRC). NCC Group plc — Annual report and accounts for the year ended 31 May 2021 189 Additional information Glossary of terms – other terms continued Other terms Gross profit Definition and usage Gross profit is revenue less direct costs of sale. It excludes costs considered to be overheads that are supporting the business as a whole as opposed to a specific revenue item. Gross margin %/GM % Calculated as gross profit divided by revenue from continuing activities. HMRC IAS or IFRS Individually Significant Items KPMG LTIP MD MDR Net debt 1 Ordinary shares SAYE/Sharesave Her Majesty’s Revenue & Customs, the tax collecting authority of the UK. An International Accounting Standard or International Financial Reporting Standard, as issued by the International Accounting Standards Board (IASB). IFRS is also used as the term to describe international generally accepted accounting principles as a whole. Financial Statements are prepared in accordance with IFRS as adopted by the EU. Items that the Directors consider to be material in nature, scale or frequency of occurrence that need to be excluded when calculating some non-GAAP performance measures in order to allow users of the Financial Statements to gain a full understanding of the underlying business performance. See Note 5 for further information. The Company’s external auditor, KPMG LLP. Long Term Incentive Plan established to align the interests of senior and Executive management with those of shareholders. The plan is formally known as the NCC Group Long Term Incentive Plan 2013 (approved by shareholders in 2013). Managing Director. Managed Detection and Response. Total borrowings offset by cash and cash equivalents. Voting shares entitling the holder to part ownership of a company. Save As You Earn, being a tax efficient scheme to encourage colleague share ownership. Software Resilience Software Resilience represents our Escrow resilience services. Subsidiary TSC TSR A company or other entity that is controlled by NCC Group. Technical Security Consulting. Total shareholder return, which is share price growth plus dividends reinvested (where applicable) over a specified period of time, divided by the share price at the start of the period. 190 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 Other information Directors Chris Stone Adam Palser Tim Kowalski – – – Chris Batterham – Non-Executive Chair Chief Executive Officer Chief Financial Officer and Company Secretary Senior Independent Non-Executive Director Jonathan Brooks – Independent Non-Executive Director Mike Ettling Jennifer Duvalier – – Independent Non-Executive Director Independent Non-Executive Director Company Secretary Tim Kowalski Registered and head office XYZ Building 2 Hardman Boulevard Spinningfields Manchester M3 3AQ Registered number 4627044 Registered in England and Wales Joint brokers and corporate finance advisers Jefferies International Limited 100 Bishopsgate London EC2N 4JL Peel Hunt LLP Moor House 120 London Wall London EC2Y 5ET Auditor KPMG LLP 1 St Peter’s Square Manchester M2 3AE Solicitors DLA Piper UK LLP 1 St Peter’s Square Manchester M2 3DE Bankers HSBC UK Bank plc 2nd Floor 4 Hardman Square Spinningfields Manchester M3 3EB National Westminster Bank plc 1 Hardman Boulevard Manchester M3 3AQ ING Bank N.V. London Branch 8–10 Moorgate London EC2R 6DA Registrars Equiniti Aspect House Spencer Road Lancing West Sussex BN99 6DA NCC Group plc — Annual report and accounts for the year ended 31 May 2021 191 Additional information Financial calendar Ex-dividend date Record date AGM Dividend payment date 2022 half year end 2022 interim statement 2022 year end 2022 year end trading pre-close statement 2022 preliminary year end statement These dates are provisional and may be subject to change. 14 October 2021 15 October 2021 4 November 2021 12 November 2021 30 November 2021 3 February 2022 31 May 2022 June 2022 July 2022 192 NCC Group plc — Annual report and accounts for the year ended 31 May 2021 NCC Group plc’s commitment to environmental stewardship is reflected in this Annual Report. The material is derived from sustainable resources and is FSC® certified. Printed in the UK by Geoff Neal. Both the mill and the printer are certified to ISO 14001 (Environmental Management System) and ISO 9001 (Quality Management System). 

Continue reading text version or see original annual report in PDF format above