Annual Financial Report

What is the risk? We invest in robots and MHE alongside our partners in the CFCs that we develop for them and we rely on the growth of our partners' online businesses to generate appropriate economic returns from this investment. If our partners do not achieve sustainable returns from their investment then they may not expand their utilisation of the capacity that we have jointly invested in, in which case we may fail to generate our planned returns. It is also possible that if our partners are unable to generate acceptable returns themselves they may close existing CFC facilities.

Key risks

?      Partners may be unable to generate sufficient demand to fill the capacity of the CFCs in which they have invested

?      Partners may be unable to operate their online grocery businesses efficiently enough to generate the planned returns, including the ability to generate density in last mile operations

?      The strategies that our partners adopt may compromise their ability to generate viable ecommerce businesses

Risk owner John Martin

Movement - increasing

Link to strategy - Grow our revenue; Optimise OSP economics; Deliver transformational technology; Drive success for our partners

Responsible business - n/a

How we manage this risk

?      We have established and expanded our Partner Success teams with the sole aim of supporting our partners in the profitable growth of their online businesses. The Partner Success teams include specialists in ecommerce, marketing, retail media, retention, operations, last mile and solutions.

?      We review and benchmark partner performance at least monthly to identify areas for improvement which we discuss with our partners.

?      We review our technology roadmap with our partners to identify specific, relevant features that we can develop to support their growth and profitability.

?      We develop training and development materials and best-practice information which we share with our partners.

?      We appoint dedicated account management and development teams to support professional account management and partner success. These teams are encouraged to locate either on or close to partner sites.

What is the risk? Disruption in our extended and complex supply chain may adversely affect product availability and responsible sourcing. This could result in increased costs and fines, delays to contractual commitments and loss of revenue.

Key risks

?      Contract performance and forecasting demand

?      Regulation and responsible sourcing (natural resources)

?      Supplier dependencies

Risk owner James Matthews

Movement - no change

Link to Strategy - Grow our revenue; Optimise OSP economics; Deliver transformational technology; Drive success for our partners; Embed a responsible business approach

Link to ESG - Our people and skills for the future; Environment and natural resources; Platform resilience and innovation

How we manage this risk

?      Improved internal forecasting of product demand and client requirements in 2023 has helped better manage Ocado's requirements.

?      Governance is provided by the Sales and Operations Planning executive review meetings.

?      Management KPI reporting packs are reviewed to align supply and demand.

?      We are embedding strategic sourcing and supplier relationship management into the business.

?      Supplier assessments, due diligence and site audits are undertaken during the product development process.

?      We are deploying materials resource planning across new categories which helps manage the areas of higher global supply chain volatility.

?      The Responsible Sourcing Working Group monitors multiple work streams and reports to the ESG Committee.

?      Combining the above capability we are now better able to review our supply chain suitability, developing deeper strategic relationships and systematically aligning scale of supply with demand to maintain confidence in our delivery. In addition, our enhancements in our people capability, systems, data and root cause analysis allow us to provide greater insight to the business to underpin strategic decision-making.

What is the risk? The disruption or loss of critical assets and sensitive information as a result of a cyber attack, insider threat or a data breach within our Group network or our supply chain could result in business interruption, reputational damage or regulatory impacts, for both Ocado and our partners.

Key risks

?      Deliberate destruction of systems

?      Commercial data loss

?      Third party compromise

?      Infrastructure outage

?      Personal data loss

Risk owner James Matthews

Movement - increasing

Link to Strategy - Deliver transformational technology; Embed a responsible business approach

Link to ESG - Platform resilience and innovation

How we manage this risk

?      Our security strategy defines priorities and is agreed with the Ocado Board.

?      Regular governance and oversight of our security programme is provided by the Information Security Committee.

?      Our Information Security function is led by our Chief Information Security Officer who is responsible for the management of our security strategy, the security programme and security risks.

?      Our dedicated Security Operations team, supported by a 24/7 specialist security partner, detects and responds to security incidents.

?      We regularly test our cyber incident response plan, including annual cyber simulations for the Executive Committee.

?      We have developed secure build standards for our core IT assets.

?      Security patching is in place for our core IT assets and is measured each month.

?      Regular penetration testing is carried out for the Ocado Platform.

?      Our zero trust solution provides employees with secure access to Ocado's systems.

?      Each year the security controls environment for the Ocado Platform is externally audited as part of our SOC2 certification.

?      The Ocado Platform is PCI compliant and is externally audited every year. No payment card data is processed directly by the Ocado Platform.

?      Cyber insurance is in place to reduce the cost impact of a major cyber incident.

?      Immutable backups have been set up to help protect the Ocado Platform from deliberate destruction.

?      Our Data Protection Officer oversees the Group's privacy compliance programme.

What is the risk? Failure to comply with local and international regulations could lead to loss of trust, penalties and personal liability for our employees, and undermine our ability to operate.

Key risks

?      Statutory compliance across jurisdictions of operation

?      Fraud, bribery, sanctions and industry specific compliance

?      New geographies

?      Accelerating pace of global regulatory change (mandatory climate-related disclosures, and wider sustainability reporting and supply chain requirements)

?      Governance

Risk owner Neill Abrams

Movement - increasing

Link to Strategy - Embed a responsible business approach

Link to ESG - Platform resilience and innovation

How we manage this risk

?      Governance is provided by the Risk Committee.

?      Co-ordinated by the Regulatory & Compliance team, the business tracks global regulatory changes, leveraging third-party advice as needed to inform our actions and respond to new requirements. The business has had to respond rapidly in 2023 to minimise disruption to our operations and supply chain and ensure we operate in a compliant manner with the dynamic changes to sanctions and export control laws in particular.

?      In 2023 our global regulations tracking process broadened to encompass wider ESG requirements and was aimed at supporting the business to prepare to meet multiple new non-financial reporting requirements.

?      Our Due Diligence and Territory Research teams conduct extensive research and engage specialist advice to understand local market regulatory issues when exploring new territories and new partners to ensure we understand and fully cost the potential risks.

?      We have deployed and continue to develop a compliance framework of policies and procedures underpinned by employee training, guidance and tailored awareness campaigns, refreshing policies where needed to reflect evolving standards, including updating our Human Rights Policy, and we are also implementing a new Sanctions and Export Control Policy.

?      We conduct periodic risk assessments on core compliance topics to ensure that we identify and close gaps arising from organisational change and evolving standards. This year we refreshed our anti-bribery risk assessment and next year we will focus on our fraud risk assessment to account for new legislation on this topic.

What is the risk? Insufficient liquidity (cash balances plus undrawn facilities) to deliver our business goals and/or settle our liabilities.

Key risks

?      Inability to access the capital markets to refinance our debt as it approaches maturity

?      Inability to extend or access our RCF including due to failure to comply with its financial covenants

?      Deterioration in financial performance (profitability and cash flow generation) that causes refinancing of existing debt to become difficult

?      Poor cash management forecasting processes leading to unanticipated shortfalls in liquidity which compromise our ability to meet our commitments

Risk owner Stephen Daintith

Movement - no change

Link to Strategy - Embed a responsible business approach

Link to ESG - Platform resilience and innovation

How we manage this risk

?      We ensure that we carry out our refinancing activities well in advance of our maturity dates.

?      We monitor the capital markets carefully and, with the assistance of our advisors, assess the accessibility of the capital markets on a regular basis (at least monthly).

?      We prepare robust five-year cash flow forecasts (which are updated annually and are tested on a regular basis for their integrity).

?      We have also prepared a five-year cash flow forecast that includes various downside scenarios and used this to determine future cash requirements, liquidity levels and covenant compliance metrics under these scenarios.

?      The five-year cash flow forecasts include all investment plans. These are reviewed by the Board (subject to materiality tests) and approved only after meeting strict return requirements.

?      Over the course of the year we have enhanced our cash flow forecasts to include quarterly compliance with financial covenants. This helps us assess our ability to access the RCF on a quarter-by-quarter basis. This gives us further comfort in our testing of sufficient liquidity headroom.

?      We engage regularly with our relationship banking group to maintain the strong relations that we have with them. We also ensure that they are well informed of our cash flows and liquidity.

?      We have recently appointed a new Head of Capital Markets to work alongside the CFO and the Group FD to maintain these strong working relationships with our relationship banks.

?      We continue to monitor the capital markets and our refinancing strategy and update the Board on these matters at each Board meeting. These Board discussions will also include a review of the optimal time to carry out any refinancing activities.