Pdf

Our risk management framework supports our strategy and long-term resilience for the benefit of our customers, shareholders and other stakeholders.

We continue to focus on creating sustainable value by delivering a high-quality customer service, at the lowest sustainable cost, while acting in a responsible manner at every level within our organisation. In our day-to-day operations we encounter a wide variety of risks which can challenge the quality, cost-effectiveness and timescales for the delivery of our aims and ambitions. We identify and plan for mitigation of these risks under our established risk management framework which includes:

  • An enterprise-wide approach to risk management;
  • Oversight and control of risk through a well-established governance and reporting process;
  • A risk assessment and management process which aligns to ISO 31000:2018; and
  • Training materials, accessible policies and guidance to help our people to identify and manage risk in a consistent manner.

Our individual business areas and functions take responsibility for identifying, quantifying, communicating and controlling the risks relevant to their own business activities. We also use a forward-looking approach to take into account new and emerging areas of concern and the long-term impact of risk. The identified risks cover a very wide range of potential events including regulatory, legal, core operations, service and hazard risks. They are reviewed and scored for likelihood as well as for financial and reputational impact should the identified event occur. Initially we use the gross position when assessing risk, i.e. we assume that any controls over the risk are absent or have failed. We then assess the current position of the risk including considering existing controls and their effectiveness. This is then followed by a targeted risk position which introduces further mitigating controls where the current state does not fully align with objectives and/or obligations.

Our governance and reporting process includes twice-yearly reports to our group board on the character of the group's risk profile, informed by the above risk identification and assessment approach. Individual event-based risks are identified and then categorised within ten inherent risk areas known as principal risks (see below). We also build on this overview in the board report, highlighting two key categories of risk: i) the most significant group-wide business risks; and ii) wholesale operational risks. These are represented by the 10 highest ranked risks (based on the scores awarded for likelihood x 'full life' financial impact) for each of the two categories plus a further five risks with potentially very high impact severity in their current state (net of control effectiveness). In addition, the report also identifies risks that could create potentially significant reputational impacts or are associated with potentially significant emerging topics but have not already been covered by the other reported categories.

Figure 1: Governance and reporting process

Group board

Reviews the nature and extent of risk, confirms the company's viability and reports on effectiveness of risk management and internal control

Wholesale risk & resilience board

Monitors status of risk, control and actions associated with wholesale risk

Group audit & risk board

Reviews governance, risk and compliance-related matters

Audit committee

Reviews the effectiveness of risk management and internal control systems

Wholesale core risk team

Monitors risk management activity, roles and responsibilities and status of wholesale operational risk

Corporate risk team

Second line framework development, advisory, assurance and reporting

Corporate audit team

Third line review and assurance of risk management and internal controls

Business areas and projects

First line identification, analysis, evaluation and management of risk

risk diagram

Board/Board Committee

Management Committee

Figure 2: Risk map

Risk Map Graphic
  1. Political and regulatory
  2. Compliance
  3. Water service
  4. Wastewater service
  5. Retail and commercial
  6. Financial
  7. Supply chain and programme delivery
  8. Resources
  9. Security
  10. Health, safety and environment

Risk increased

Risk stable

Risk decreased

The risk map provides an indicative only view of the current exposure of each of the principal risks relative to each other: illustrating the likelihood of occurrence relative to the associated internal or external drivers; whether the risk is believed to have increased, decreased or remained stable over the last 12 months; and the most likely (not worst case) impact should an event occur.

Our approach aligns with the UK Corporate Governance Code and includes reports to the group board for every full and half year statutory accounting period so that the board is in a position to:

  • Determine the nature and extent of the principal risks it is willing to take in achieving its strategic objectives;
  • Oversee the management of those risks and provide challenge to executive management where appropriate;
  • Express an informed opinion on the long-term viability of the company; and
  • Monitor risk management and internal control systems and review their effectiveness.

Figure 3: Assessment and management process adapted from ISO 31000:2018

Iso Diagram

Key developments

Key developments include a maturing of and increased formalisation of our risk appetite framework. Our framework supports our assessment of the extent of risk we are willing to take based on obligations, stakeholders' requirements and the company's capacity and capability to manage risk. By doing this we aim to influence the target position for individual risks underpinning the principal risks through improved consistency. This approach also enables better benchmarking of individual risks against the appetite limits and boundaries. We have also sought to make an incremental governance improvement in our sign-off processes for all risks and also in relation to the wholesale risk and resilience board (see Figure 1) and the core risk team meetings which focus on long-term resilience. Associated with this is a focus on asset health and operational hazard risk assessment in advance of and beyond PR19. This supports our understanding of the long-term risk profile of our asset base and improves our capability to deliver the most cost-effective and proportionate risk management response as a result.

Profile features

Our risk profile currently consists of around 200 event-based risks. By their nature, these will include all combinations of high to low likelihood and high to low impact. Heat maps are typically used in various managerial and group reports either as a method to evaluate the extent of multiple risks within a certain profile or to evaluate the effectiveness of mitigation for a single risk relative to the initial gross position.

Political and regulatory risk and uncertainty feature prominently within the profile, notably with the outcome of PR19 which is expected to be even tougher than previous price reviews. The possibility of 'Renationalisation' is a key area of uncertainty as is the opening up to competition of wholesale operations (including the current focus on possible competition in bioresources and water abstraction) and the potential for competition covering domestic retail activities.

Our operations continue to be substantially UK-based, but the potential impacts of 'Brexit' remain under review and have been reported to the group board. In common with other UK companies, a significant issue is the uncertainty surrounding the effects of the Brexit deal that the UK Government ultimately delivers. Our review has considered the availability of European funding, the price of goods and services, exchange rate impacts, possible impacts on our ability to collect cash were there to be an economic downturn and the effect of any potential inflationary shift outside current predicted parameters. We continue to keep this area under review.

Following the launch of non-household retail competition in April 2017, we have continued to monitor our operations within the market to review compliance risks and ensure that we continue to operate in a manner that complements and promotes the 'level playing field'.

From an operational risk perspective, the dominance of the penalty element of Ofwat's outcome delivery incentive mechanism and the effect following changes to the Environmental Sentencing Guidelines are key features of evolving exposure. Reputationally, our core operations/service provision (notably water service) and health, safety and environmental risks have the highest focus for monitoring and reviewing control effectiveness based on the potential impact should the risk event occur.

We continue to adapt to and plan for climate change and its significant and permanent impacts on the water cycle, our operations and the broader operating environment. This includes consideration of the long-term viability of water and wastewater services such as water abstraction, drinking water supply and treatment capability, drainage and sewer capacity, wastewater treatment and its discharge efficiency and effectiveness. The recommendations of the Task Force on Climate-related Financial Disclosures (TCFD) support and reinforce the need to consider climate-related risks and uncertainties. These continue to be factored into risk management and the likely effects of future changes are a critical consideration in our long and medium-term risk, operational and financial planning (see also Key Resources and the Business Insight). Our water service and wastewater service risks (summarised in the table in the How we manage risks) section also reflect current key risks including the potential for extreme weather and climate change.

Material litigation

The group robustly defends litigation where appropriate and seeks to minimise its exposure by establishing provisions and seeking recovery wherever possible. Litigation of a material nature is regularly reported to the group board. While our directors remain of the opinion that the likelihood of a material adverse impact on the group's financial position is remote, based on the facts currently known to us and the provisions in our statement of financial position, the following two cases are worthy of note:

  • In February 2009, United Utilities International Limited (UUIL) was served with notice of a multiparty 'class action' in Argentina related to the issuance and payment default of a US$230 million bond by Inversora Eléctrica de Buenos Aires S.A. (IEBA), an Argentine project company set up to purchase one of the Argentine electricity distribution networks which was privatised in 1997. UUIL had a 45 per cent shareholding in IEBA which it sold in 2005. The claim is for a non-quantified amount of unspecified damages and purports to be pursued on behalf of unidentified consumer bondholders in IEBA. UUIL has filed a defence to the action and will vigorously resist the proceedings given the robust defences that UUIL has been advised that it has on procedural and substantive grounds. There have been no material developments in this matter over the last 12 months; and
  • In March 2010, Manchester Ship Canal Company (MSCC) issued proceedings seeking, amongst other relief, damages alleging trespass against United Utilities Water Limited (UUW) in respect of UUW's discharges of water and treated effluent into the canal. While the matter has not reached a final conclusion, the Supreme Court has found substantively in UUW's favour on a significant element of the claim and the High Court has upheld UUW's position on the remainder of the proceedings. MSCC have now instigated further heads of claim against UUW in order that they may continue to challenge UUW's rights to discharge water and treated effluent into the canal.

Principal risks

The principal risks (combinations of event-based risks), which have been set out in the risk map and summarised in the table within the How we manage risks section reflect the categories of risks that define business activity or contributing factors where value can be lost or gained and could have a material impact on the business model, future performance, solvency or liquidity of the group. In each case the nature and the extent of exposure is highlighted together with the extent of management/mitigation. To ensure relevance with the current environment, issues or areas of uncertainty are also illustrated.

Strategic objectives

The best service to customers

At the lowest sustainable cost

In a responsible manner

Risk exposure

An indication of each category's current exposure relative to the previous year is shown by the arrow in the risk exposure column

Blue Up Arrow Increased

Blue Left Right Arrow Stable

Blue Down Arrow Decreased

Regulatory & legal

Potential change in the political and regulatory environment and/or frameworks

Main business objective

Principal/significant impacts

The potential increase in costs of administration, reduced income, margin and greater variability of returns

The potential loss of confidence of equity investors and challenging debt market conditions create funding pressures given the need to raise finance and refinance debt on an ongoing basis

The possibility on a potential Renationalisation that the business is acquired below fair value

Risk exposure

Blue Up Arrow

Management and mitigation

We engage in relevant government and regulatory consultations which may affect policy and regulation in the sectors where we operate. We also consult with customers to understand their requirements and proactively consider all the opportunities and threats associated with any potential change; exploiting opportunities and mitigating risks where appropriate. We keep customers and the public informed. We also provide information to the government, regulators, customers and the public as appropriate to help them to make informed decisions.

Current key risks, issues and uncertainties

  • Potential Renationalisation of the water sector
  • Market reform including upstream competition and, further ahead, the potential for the introduction of domestic competition
  • Change from using the retail prices index to the consumer prices index for regulatory indexation
  • Brexit

The failure to meet all legal and regulatory obligations and responsibilities

Main business objective

Principal/significant impacts

The potential to receive penalties of up to ten per cent of relevant turnover and ultimately revocation of our licence or the appointment of a special administrator

Risk exposure

Blue Left Right Arrow

Management and mitigation

Legislative and regulatory developments are continually monitored as is the governance framework utilised by the group. Risk-based training of employees is undertaken and we participate in consultations to influence legislative and regulatory developments. Allowance for any material additional compliance costs in the regulated business is sought as part of the price determination process. The group also robustly defends litigation where appropriate and seeks to minimise its exposure by establishing provisions and seeking recovery wherever possible.

Current key risks, issues and uncertainties

  • Competition law and regulatory compliance while preparing for and operating within a changing competitive market
  • Level playing field requirements in relation to the non-household retail market
  • Current material litigation
  • Higher fine levels for environmental offences
  • Introduction of material pieces of legislation e.g. the General Data Protection Regulation

Core operations and service provision

A failure to provide a secure supply of clean, safe drinking water and the potential for negative impact on public confidence in water supply

Main business objective

Principal/significant impacts

The potential for public health issues associated with poor water quality

The potential for supply interruptions that could affect large populations within the region for long durations

Risk exposure

Blue Up Arrow

Management and mitigation

Mitigation is provided through core business processes, including centralised planning and control, quality assurance procedures, risk assessments and rigorous sampling/testing regimes. Optimisation of operational and maintenance tasks together with targeted capital interventions help to ensure services to customers are maintained. Our 25-year Water Resources Management Plan defines our strategy to achieve a long-term, best-value and sustainable plan for water supplies in the North West including consideration of over 20 different climate change scenarios including a 2oC or lower global warming scenario (assessing systems resilience). We continue to develop innovative solutions and invest in resilience to further support the delivery of water and wastewater services in the long-term.

Current key risks, issues and uncertainties

  • Population growth
  • Extreme weather and climate change
  • Meeting infrastructure investment requirements
  • Expected change to the abstraction licensing regime
  • Catchment management
  • Raw water quality
  • Drinking water safety and security
  • Critical asset failure
  • Drought

A failure to remove and treat wastewater

Main business objective

Principal/significant impacts

The potential for serious pollution (including sewer flooding) leading to disruption to the public, businesses and the environment (wildlife, fish and natural habitats) resulting in fines and reputational damage

Risk exposure

Blue Left Right Arrow

Management and mitigation

Mitigation is provided through core business processes, including centralised planning and control, quality assurance procedures, risk assessments and rigorous sampling/testing regimes. Optimisation of operational and maintenance tasks together with targeted capital interventions help to ensure services to customers are maintained. Our 25-year Water Resources Management Plan defines our strategy to achieve a long-term, best-value and sustainable plan for water supplies in the North West including consideration of over 20 different climate change scenarios including a 2oC or lower global warming scenario (assessing systems resilience). We continue to develop innovative solutions and invest in resilience to further support the delivery of water and wastewater services in the long-term.

Current key risks, issues and uncertainties

  • Population growth
  • Extreme weather and climate change
  • Meeting infrastructure investment requirements
  • Expected change to the abstraction licensing regime
  • Catchment management
  • Raw water quality
  • Drinking water safety and security
  • Critical asset failure
  • Drought

Failing to provide good and fair service to domestic customers and third-party retailers

Main business objective

Principal/significant impacts

The potential for significant regulatory penalties and long-term reputational damage associated with poor customer satisfaction

The potential for a significant increase in the bad debt charge, reducing profitability

Risk exposure

Blue Down Arrow

Management and mitigation

For Domestic Retail there are a wide range of initiatives and activities focused on improving customer satisfaction, including proactive incident communication, complaints handling and use of appropriate tariffs. Bad debt risk is managed through the adoption of best practice collection techniques, segmentation of customers based on their credit risk profile and the use of data sharing to better understand customers' circumstances to determine the most appropriate collection and support activities. Our wholesale business maintains processes, systems, data and organisational capacity and capability to deal fairly with market participants and the central market operator in the Business Retail market in order to generate and collect revenue.

Current key risks, issues and uncertainties

  • Socio-economic deprivation in the North West
  • Welfare reform and the impact on domestic bad debt
  • Competition in the water and wastewater market and competitor positioning
  • Brexit
  • Non-household retail competition and the ability to treat other participants equally

Functional service & support

Potential inability to finance the business appropriately

Main business objective

Principal/significant impacts

The potential for worse credit ratings, associated funding costs or reduced access to debt capital markets leading to lower liquidity and adversely impacting the economic return on the regulatory capital value (RCV)

The potential for a worsening of the pension scheme funding position leading to a requirement for the group to make additional contributions

Risk exposure

Blue Down Arrow

Management and mitigation

Refinancing is long-term with staggered maturity dates to minimise the effect of short-term downturns. Counterparty credit exposure and settlement limits exist to reduce any potential future impacts. These are based on a number of factors, including the credit rating and the size of the asset base of the individual counterparty. The group also employs hedging strategies to manage the impact of market fluctuations for inflation, interest rates and energy prices. Sensitivity analysis is carried out as part of the business planning process, influencing the various financial limits employed. Continuous monitoring of the markets takes place including movements in credit default swap prices and movements in equity levels.

Current key risks, issues and uncertainties

  • Stability of financial institutions and the world economy
  • Economic uncertainty
  • Inflation/deflation
  • Financial market conditions, interest rates and funding costs
  • Brexit

Potential ineffective delivery of capital, operational and change programmes/processes

Main business objective

Principal/significant impacts

The potential failure to meet our obligations and customer outcomes resulting in an impact at future price reviews, negative reputational impact with customers and regulators

Risk exposure

Blue Left Right Arrow

Management and mitigation

Supply chain management is utilised to deliver an end-to-end contract management service, including contract strategy, tendering and category management, which provides a risk-based approach and relationship management programmes for suppliers. We prioritise our investment programmes, projects and integrated business and asset plans. We have created better alignment and integration between our capital delivery partners and engineering service providers including alignment with our operating model. Our programme and project management capabilities are well established with strong governance and embedded processes to support delivery, manage risks and achieve business benefits. We utilise a time, cost and quality index (TCQi) as a key performance indicator and enhance our performance through a dedicated programme change office to deliver change in a structured and consistent way.

Current key risks, issues and uncertainties

  • Security of supply
  • Delivery of solutions
  • Technical quality and innovation
  • Brexit

Failing to provide appropriate resources (human, technological or physical resource) required to support business activity

Main business objective

Principal/significant impacts

The potential inability to recruit and retain knowledge/expertise

The potential inability to respond and recover due to ineffective non-resilient business activity

Risk exposure

Blue Left Right Arrow

Management and mitigation

Developing our people with the right skills and knowledge, combined with delivering effective technology are important enablers to support the business to meet its objectives. Employees are kept informed regarding business strategy and progress through various communication channels. Training and personal development programmes exist for all employees in addition to talent management programmes and apprentice and graduate schemes. We focus on change programmes and innovative ways of working to deliver better, faster and more cost-effective operations.

Current key risks, issues and uncertainties

  • Delivering required employee engagement
  • Personal development and talent management
  • Technological innovation
  • Asset management

Hazard-based

Potential for malicious activity (physical or technological) against people, assets or operations

Main business objective

Principal/significant impacts

The potential for a loss of data/information and the consequent effect on service provision

The potential for catastrophic damage to UU property, infrastructure and non-infrastructure and the consequent effect on service provision

Risk exposure

Blue Up Arrow

Management and mitigation

Physical and technological security measures and awareness training combined with strong governance and inspection regimes aim to protect infrastructure, assets and operational capability. Externally, we work closely with our industry peers, the Centre for the Protection of National Infrastructure (CPNI), the National Cyber Security Centre (NCSC) and Defra to shape the sector approach to security, particularly cyber security, and to understand how we can best deliver the appropriate levels of protection to our business. Ongoing system and network integration improves operational resilience and we maintain robust incident response, business continuity and disaster recovery procedures. We also maintain insurance cover for loss and liability and the licence of the regulated business also contains a 'shipwreck' clause that, if applicable, may offer a degree of recourse to Ofwat/customers in the event of a catastrophic incident.

Current key risks, issues and uncertainties

  • Cybercrime
  • Terrorism
  • Fraud
  • Ownership of Critical National Infrastructure and National Infrastructure

Potential harm to people (employees, contractors or the public) and the environment

Main business objective

Principal/significant impacts

The potential for serious injury or loss of life in remote, extreme circumstances

The potential for catastrophic damage to private, public or commercial property/infrastructure including the consequent effect on water and wastewater service provision

The potential for serious impact to wildlife, fish or natural habitats resulting in significant fines and reputational damage

Risk exposure

Blue Left Right Arrow

Management and mitigation

Supported by strong governance and management systems certified to OHSAS 18001 we have developed a strong health and safety culture where 'nothing we do at United Utilities is worth getting hurt for'. We actively seek to improve health, safety and wellbeing across the group through targeted improvements and benchmarking against our peers. Also certified to ISO 14001, we seek to protect and improve the environment through the responsible delivery of our services. This includes helping to support rare species and habitats through targeted engagement and activity and commitment to reducing our carbon emissions by designing out waste from our operations, generating our own energy and looking at ways to reduce our use of raw materials. We also recognise the impact the environment can have on our service provision with extreme weather and climate change being integrated into our risk, planning and decision-making processes.

Current key risks, issues and uncertainties

  • Impounding reservoirs containing significant volumes of water
  • Other critical asset failure
  • Process safety
  • Excavation, tunnelling and construction work
  • Working with chemicals
  • Fluvial and coastal flooding