Our risk management approach supports our focus on customer service, resilience, reputation and shareholder value.

Our strategy is to create sustainable value by delivering the best service to customers, at the lowest sustainable cost and in a responsible manner. In doing this, the group is exposed to a range of internal and external risks of varying types which can impact upon us and the delivery of our objectives and operations. To understand and manage these risks, we maintain a risk management framework which includes:

  • an enterprise-wide approach to risk management;
  • a well-established governance and reporting structure (see figure 1);
  • a risk assessment and management process which is aligned to ISO 31000:2009 (see figure 2 opposite); and
  • a suite of tools, guidance material and training packages to support consistency of approach.

Business areas and functions are responsible for the identification, analysis, evaluation and management of risk relative to their business environment including new and emerging circumstances. All event types (including regulatory, legal, core operations, service and hazard) are considered for their likelihood of occurrence and both the financial and reputational impact should that event occur. Each assessment takes into account a gross position (assuming no controls or that all controls fail), a current position benefiting from an analysis of the type and effectiveness of existing controls and a targeted position where further mitigation may be required if the current position is evaluated as not meeting our objectives or obligations.

The nature and extent of the risk profile culminating from this structured approach is reported to the group board twice a year, illustrating individual event-based risks that underpin 10 inherent risk categories that are regarded as the principal risks (see below). From this initial overview, the report then focuses on two categories of risk: i) the most significant group-wide business risks and ii) wholesale operational risks. These are represented by the 10 highest ranked risks (based on likelihood x 'full life' financial impact) for each of the two categories and a further five risks with potentially very high impact severity in their current state (net of control effectiveness) with reputational impact noted for awareness and management. The report also highlights risks that fall outside these categories but are included due to potential reputational impact or because they are notable new/emerging circumstances.

This approach is in line with the principles of the UK Corporate Governance Code and involves reporting to the group board for each full and half year statutory accounting period allowing the board to:

  • determine the nature and extent of the principal risks it is willing to take in achieving its strategic objectives;
  • oversee the management of those risks and provide challenge to executive management where appropriate;
  • express an informed opinion on the long-term viability of the company (see Code principles continued); and
  • monitor risk management and internal control systems and review their effectiveness.

Group Board

Reviews the nature and extent of risk, confirms the company's viability and reports on effectiveness of risk management and internal control

Group Audit & Risk Board

Reviews governance, risk and compliance-related matters

Corporate Risk Team

Second line framework development, advisory, assurance and reporting

Business Areas and Projects

First line identification, analysis, evaluation and management of risk

Audit Committee

Reviews the effectiveness of risk management and internal control systems

Corporate Audit Team

Third line review and assurance of risk management and internal controls

Figure 1: Governance and reporting process

Figure 2: Assessment and management process adapted from ISO 31000:2009

Our risk profile currently consists of around 120 event-based risks. By their nature, these will include all combinations of high to low likelihood and high to low impact. Heat maps are typically used in various managerial and group reports, either as a method to collectively evaluate the extent of multiple risks within a certain profile or to evaluate the effectiveness of mitigation for a single risk relative to the initial gross position.

Key features and developments

Our risk profile shows that, for each set of the 10 highest ranked risks (one set for each of group-wide business risks and wholesale operational risks), the majority fall into the principal risk areas 'Political and regulatory', 'Water service' and 'Wastewater service'. Operationally, the dominance of the penalty element of the outcome delivery incentive mechanism and the effect following changes to the Environmental Sentencing Guidelines are key features of this exposure. Reputationally, our core operations/service provision (notably water service) and health, safety and environmental risks have the highest focus for monitoring and reviewing control effectiveness based on the potential impact should the risk event occur.

We aim for continuous improvement in both our governance and approach to managing risk. Changes this year include the introduction of a core risk team and additional sign-off processes relating to operational risk. We have also developed a programme focused on long-term resilience of assets, overseen by the newly formed wholesale resilience board. Associated with this is a focus on asset health and operational hazard risk assessment in advance of and beyond the 2015-20 regulatory period. This should ensure that we fully understand the long-term risk profile of our asset base and improve our capability to deliver the most cost-effective and proportionate risk management response. Other developments include: an ongoing transformation programme (with the Drinking Water Inspectorate) to address some areas of concern arising from the Lancashire incident in 2015; system optimisation in wastewater services through a remote monitoring and control transformation project; and in domestic retail, a customer service improvement plan underpinned by a clear strategy, improved complaints handling, accurate data and cultural change.

The introduction of non-household retail competition required significant preparation. Ensuring we continue to operate compliantly and in accordance with 'level playing field' requirements remains a key area of focus.

Whilst most of our operations are in the UK, the potential effects of 'Brexit' have been considered, assessed and reported to the group board. Like many companies, a key issue is the level of uncertainty that exists. Our assessment included sources of funds, costs of goods and services, our ability to collect cash in the event of an economic downturn and the effect of any potential inflationary shift over current predictions. This area remains under review.

Looking further ahead, the expected introduction of competition in relation to certain wholesale activities and the possible introduction of competition in the provision of household retail activities at some future date all place risk on the group.

It is also important to acknowledge other potential significant change in environment and societal conditions. Climate change is expected to be one of the sector's biggest challenges, having significant and permanent implications on the water cycle and the long-term sustainability of water and wastewater services including water abstraction, supply and treatment capability, drainage, sewer capacity, wastewater treatment and discharge efficiency and effectiveness.

Material litigation

The group robustly defends litigation where appropriate and seeks to minimise its exposure by establishing provisions and seeking recovery wherever possible. Litigation of a material nature is regularly reported to the group board. Two cases of particular note are as follows, however, based on the facts currently known to us and the provisions in our statement of financial position, our directors remain of the opinion that the likelihood of these having a material adverse impact on the group's financial position is remote.

  • In February 2009, United Utilities International Limited (UUIL) was served with notice of a multiparty 'class action' in Argentina related to the issuance and payment default of a US$230 million bond by Inversora Eléctrica de Buenos Aires S.A. (IEBA), an Argentine project company set up to purchase one of the Argentine electricity distribution networks which was privatised in 1997. UUIL had a 45 per cent shareholding in IEBA which it sold in 2005. The claim is for a non-quantified amount of unspecified damages and purports to be pursued on behalf of unidentified consumer bondholders in IEBA. UUIL has filed a defence to the action and will vigorously resist the proceedings given the robust defences that UUIL has been advised that it has on procedural and substantive grounds.
  • In March 2010, Manchester Ship Canal Company (MSCC) issued proceedings seeking, amongst other relief, damages alleging trespass against United Utilities Water Limited (UUW) in respect of discharges of water and treated effluent into the canal. Whilst the matter has not reached a final conclusion, the Supreme Court has found substantively in UUW's favour on a significant element of the claim and the High Court has upheld UUW's position on the remainder of the proceedings. MSCC have now instigated further heads of claim against UUW in order that they may continue to challenge UUW's rights to discharge water and treated effluent into the canal.

Principal risks

The principal risks (aggregated clusters of event-based risks), which have been set out in the table below reflect the categories of risks that define business activity or contributing factors where value can be lost or gained and could have a material impact on the business model, future performance, solvency or liquidity of the group. In each case the magnitude of the potential effect is highlighted together with the extent of management/mitigation. To ensure relevance with the current environment, issues or areas of uncertainty are also illustrated.

Strategic objectives

The best service to customers

At the lowest sustainable cost

In a Responsible manner

Risk exposure

An indication of each category's current exposure relative to the previous year is shown by the arrow in the risk exposure column.

Reducing

Stable

Increasing

Risk description

Political and regulatory risk

Potential change in the political and regulatory environment and/or frameworks

Strategic objective

 

Potential impact

Changes to regulation and the regulatory regime (either through political or regulatory events, for example following Brexit) may increase costs of administration, reduce income and margin and lead to greater variability of returns.

Current key risks, issues or areas of uncertainty include

  • Market reform including non-household and upstream competition and, further ahead, the potential for the introduction of household competition
  • A possible change from using the Retail Prices Index to the Consumer Prices Index for regulatory indexation
  • Brexit

Risk exposure

Management and mitigation

We engage in relevant government and regulatory consultations which may affect policy and regulation in the sectors where we operate. We also consult with customers to understand their requirements and proactively consider all the opportunities and threats associated with any potential change, exploiting opportunities and mitigating risks where appropriate.

Risk description

Compliance risk

The potential failure to meet all legal and regulatory obligations and responsibilities

Strategic objective

 

Potential impact

Reputational, brand and general damage arising from non-compliance with existing or future laws/regulations (principally relating to the regulated business, but also including non-regulated activity/commitment) can result in additional workload, financial penalties, additional capital/operating expenditure (from enforcement orders or legal defence) and compensation following litigation. In more remote but extreme circumstances, penalties of up to 10 per cent of relevant turnover and ultimately revocation of our licence or the appointment of a special administrator are possible.

Current key risks, issues or areas of uncertainty include

  • Competition law and regulatory compliance whilst preparing for and operating within a changing competitive market
  • Level playing field requirements in relation to non-household retail
  • Current material litigation
  • New higher fine levels for environmental offences

Risk exposure

Management and mitigation

Legislative and regulatory developments are continually monitored. Risk-based training of employees is undertaken and we participate in consultations to influence legislative and regulatory developments. Funding for any material additional compliance costs in the regulated business is sought as part of the price determination process. The group also robustly defends litigation where appropriate and seeks to minimise its exposure by establishing provisions and seeking recovery wherever possible.

Risk description

Water service risk

Potential failure of water operational processes or assets

Strategic objective

 

Potential impact

Operational performance problems or service or asset failures can lead to a failure to provide a secure supply of clean, safe drinking water or an inability to remove, treat and return water to the environment. This can cause public health, community and environmental impacts, additional operating or capital expenditure and/or increased regulatory scrutiny and regulatory penalties. In more extreme situations the group could also be fined for breaches of statutory obligations, be subject to enforcement action, be held liable to third parties and sustain reputational damage.

Current key risks, issues or areas of uncertainty include

  • Water quality
  • Interruption to supply
  • Structural integrity of major assets
  • Pollution
  • Population growth
  • Climate change
  • Meeting infrastructure investment requirements
  • Expected change to the abstraction licensing regime

Risk exposure

Management and mitigation

Mitigation is provided through core business processes, including forecasting, quality assurance procedures, risk assessments and rigorous sampling/testing regimes. Ongoing system and network integration improves service provision and measures of success have been developed to monitor performance. Following the Lancashire water quality incident in 2015 we are further enhancing our approach to operational risk and resilience.

Risk description

Wastewater service risk

Potential failure of wastewater operational processes or assets

Strategic objective

 

Potential impact

Operational performance problems or service or asset failures can lead to a failure to provide a secure supply of clean, safe drinking water or an inability to remove, treat and return water to the environment. This can cause public health, community and environmental impacts, additional operating or capital expenditure and/or increased regulatory scrutiny and regulatory penalties. In more extreme situations the group could also be fined for breaches of statutory obligations, be subject to enforcement action, be held liable to third parties and sustain reputational damage.

Current key risks, issues or areas of uncertainty include

  • Water quality
  • Interruption to supply
  • Structural integrity of major assets
  • Pollution
  • Population growth
  • Climate change
  • Meeting infrastructure investment requirements
  • Expected change to the abstraction licensing regime

Risk exposure

Management and mitigation

Mitigation is provided through core business processes, including forecasting, quality assurance procedures, risk assessments and rigorous sampling/testing regimes. Ongoing system and network integration improves service provision and measures of success have been developed to monitor performance. Following the Lancashire water quality incident in 2015 we are further enhancing our approach to operational risk and resilience.

Risk description

Retail and commercial risk

Potential inability to provide good and fair service to domestic customers and third party retailers

Strategic objective

 

Potential impact

Poor service to customers can result in financial penalties and an impact on regulatory reputation. The opening of the market for retail services to all non-household customers in England in April 2017 has generated both opportunities and risk for the group and its associated business retail function in respect of income, margin and debt. Breaches of legal and regulatory requirements could lead to fines, penalties and reputational damage. Uncertainty remains in respect of potential upstream reform from 2020.

Current key risks, issues or areas of uncertainty include

  • Socio-economic deprivation in the North West
  • Welfare reform and the impact on domestic bad debt
  • Competition in the water and wastewater market and competitor positioning
  • Market reform and the ability to treat other participants equally

Risk exposure

Management and mitigation

For domestic retail there is a transformation plan in place covering a wide range of initiatives and activities to improve customer service, with a number of controls in place to monitor achievement against the plan. Similarly, within business retail we looked to retain existing and acquire new commercial customers by striving to meet their needs more effectively. We monitored competitor activity and targeted a reduction in operating costs. Within our wholesale department processes, systems, data and organisational capacity and capability to deal with market participants and the central market operator have been delivered. The new market requirements will require all market participants to treat other participants equally (on a 'level playing field') whilst maintaining compliance with existing regulations.

Risk description

Financial risk

Potential inability to appropriately finance the business

Strategic objective

 

Potential impact

The failure of financial counterparties could result in additional financing cost, an adverse impact on the income statement and potential reputational damage. Variability in inflation (as measured by the UK Retail Prices Index) and changes in interest rates, funding costs and other market risks could adversely impact the economic return on the Regulatory Capital Value. Increased pension scheme deficit could lead to a requirement for the group to make additional contributions. In extreme but remote cases adverse market conditions could affect our access to debt capital markets and subsequently available liquidity and credit ratings.

Current key risks, issues or areas of uncertainty include

  • Stability of financial institutions and the world economy
  • Economic uncertainty
  • Inflation/deflation
  • Financial market conditions, interest rates and funding costs

Risk exposure

Management and mitigation

Refinancing is long-term with staggered maturity dates to minimise the effect of short-term downturns. Counterparty credit, exposure and settlement limits exist to reduce any potential future impacts. These are based on a number of factors, including the credit rating and the size of the asset base of the individual counterparty. The group also employs hedging strategies to stabilise market fluctuation for inflation, interest rates and commodities (notably energy prices). Sensitivity analysis is carried out as part of the business planning process, influencing the various financial limits employed. Continuous monitoring of the markets takes place including movements in credit default swap prices and movements in equity levels.

Risk description

Programme delivery risk

Potential ineffective delivery of capital, operational and change programmes/processes

Strategic objective

 

Potential impact

Failure to deliver capital or change programmes against relevant time, cost or quality measures could result in a failure to secure competitive advantage or operating performance efficiency and cost benefits. There is also the risk of increased delivery costs or a failure to meet our obligations and customer outcomes which, depending on the nature and extent of failure, could result in an impact at future price reviews, failure of legal or regulatory obligations and subsequent penalties. This could lead to negative reputational impact with customers and regulators.

Current key risks, issues or areas of uncertainty include

  • Security of supply
  • Delivery of solutions
  • Quality and innovation
  • New contract delivery partnerships for the 2015-2020 period with a new approach to construction and design

Risk exposure

Management and mitigation

We have a developed and clear view of our investment priorities which are built into our programmes, projects and integrated business and asset plans. We have created better alignment and integration between our capital delivery partners and engineering service provider including alignment with our operating model. Our programme and project management capabilities are well established with strong governance and embedded processes to support delivery, manage risks and achieve business benefits. We utilise a Time, Cost and Quality index (TCQi) as a key performance indicator and enhance our performance through a dedicated programme change office to deliver change in a structured and consistent way. Supply chain management is utilised to deliver end-to-end contract management which includes contract strategy and tendering, category management, security of supply, price and price volatility and financial and operational service level performance.

Risk description

Resource risk

The potential inability to provide appropriate resource (human, system, technological or physical) required to support business activity

Strategic objective

 

Potential impact

The capacity or capability associated with human, technological and physical resource (including information, operational technology, skill sets, systems and telecommunications) can lead to poor efficiency and effectiveness of business activity, the inability to make appropriate decisions and ultimately meet targets. This can also affect the ability to recruit and retain knowledge/expertise or to recover effectively following an incident. In remote but extreme circumstances there is also the potential for higher levels of regulatory scrutiny, financial penalties, reputational damage and missed commercial opportunities.

Current key risks, issues or areas of uncertainty include

  • Delivering required employee engagement
  • Personal development and talent management
  • Technological innovation
  • Asset management

Risk exposure

Management and mitigation

Developing our people with the right skills and knowledge, combined with delivering effective technology, are important enablers to support the business to meet its objectives. Employees are kept informed regarding business strategy and progress through various communication channels. Training and personal development programmes exist for all employees in addition to talent management programmes and apprentice and graduate schemes. We focus on change programmes and innovative ways of working to deliver better, faster and more cost-effective operations.

Risk description

Security risk

The potential inability to protect people, information, infrastructure and non-infrastructure from malicious or accidental activity

Strategic objective

 

Potential impact

Our resources, assets and infrastructure are exposed to various threats (malicious or accidental) which could impact the provision of vital services and/or harm people or commercial businesses. In addition, commercial or sensitive information could be lost.

Current key risks, issues or areas of uncertainty include

  • Ownership and operation of National Infrastructure and Critical National Infrastructure
  • Cybercrime
  • Terrorism

Risk exposure

Management and mitigation

Physical and technological security measures combined with strong governance and inspection regimes aim to protect infrastructure, assets and operational capability. Recent initiatives include awareness training across the business relating to seven key areas of security and the implementation of a security governance model to oversee all aspects of security and security strategy. Ongoing system and network integration improves operational resilience and we maintain robust incident response, business continuity and disaster recovery procedures. We also maintain insurance cover for loss and liability and the licence of the regulated business also contains a 'shipwreck' clause that, if applicable, may offer a degree of recourse to Ofwat/customers in the event of a catastrophic incident.

Risk description

Health, safety and environmental

Potential for operational or natural hazards to affect employees, contractors, the public or the environment

Strategic objective

 

Potential impact

Working with and around water, sewage, construction and excavation sites, plant and equipment exposes people and the environment to man-made and naturally occurring hazards. This could result in harm to people, wildlife and natural habitats and lead to increased work down time and additional operational costs, for example environmental clean-up. Depending on the circumstances, the group could be fined heavily for breaches of statutory obligations, be held liable to compensate third parties and sustain severe reputational damage.

Current key risks, issues or areas of uncertainty include

  • Extreme weather conditions
  • Excavation, tunnelling and construction work
  • Working with substances hazardous to human health
  • Working with water and wastewater
  • Driving and vehicle movement

Risk exposure

Management and mitigation

We have developed a strong health, safety and environmental culture where 'nothing we do at United Utilities is worth getting hurt for'. This is supported by strong governance and management systems which include policies and procedures which are certified to OHSAS 18001 and ISO 14001.