Peachtree 2015 Annual Report Download - page 45

Principal Risk Risk Background Management and Mitigation
9. Information Management and Protection (including cyber)
Sage fails to adequately
understand, manage and
protect data
During the period of acquisition many established
processes, whilst appropriate to smaller businesses,
did not develop in line with Sage’s growth.
This risk is an evolution from 2014. During 2015,
organisational and structural changes have been
made to manage the risk and to transition to the
new ways of working.
– Creation of a global ‘OneIT’ function reporting to the global
Chief Information Officer, to support the operation of
'One Sage’ through common supporting IT infrastructure,
practices and systems
– A network of Information Security Officers oversees compliance
with the IT Controls Framework, which defines
the key controls which are required
– Maintenance of formal certification schemes, such as PCI,
across specific parts of the business, with internal and external
validation of compliance
– On-going assurance activities are performed across the estate
by Internal Auditagainst the IT Controls Framework. Results
are tracked and reported to the Audit and Risk Commiee
In progress:
– Global incident management procedures including rating
of incidents and escalation, as required
– Excellence in Governance initiative being undertaken across
revised ways of working and policies to enhance effectiveness
10. Regulatory and Legal Framework
Sage fails to understand
and effectively operate
within the legal and
regulatory framework
applying to its services
Sage operates in an increasingly complex external
environment, while at the same time continuing to
evolve its service offerings to the market. Many of
Sage’s activities and services are subject to legal
and regulatory influences, which continue to
develop in parallel.
It is therefore essential to monitor the evolving legal
and regulatory environment, understand in a timely
manner how this applies to the business, and take
appropriate steps to ensure compliance.
This risk is an evolution from 2014.
– All legal resources across Sage report directly to the global
Legal Director
– The legal function uses internal and external resources
to monitor planned and realised changes in legislation
– All product contracts are reviewed and approved through
the global legal function
– A suite of policies are in place to support key legislation,
including Data Protection and anti-Bribery
– A Code of Ethics policy is in place across the business which
provides clarity over how colleagues are expected to behave.
On-line training is provided to support it, and to record levels
of understanding
– A Group Whistleblowing policy and arrangements are in operation,
to allow colleagues to raise issues without fear of recrimination,
and to provide early oversight of issues
In progress:
– Development and communication of the 'Sage Way' of working,
and on-going drive towards a 100% compliance culture
Developing the financial viability statement
In developing the financial viability statement, it was determined that a five year period should be used, consistent with the period of the Group’s
strategic plan and reflecting a typical life of on-premise products without upgrade.
Management reviewed the principal risks, and considered which of these risks might threaten the Group’s viability. It was determined that none of
the individual risks would in isolation compromise the Group’s viability, and so a number of different severe but plausible principal risk combinations
were considered.
Having identified the severe but plausible risk combinations, a cross functional group of senior managers, including representatives from Finance,
Risk, IT, Product Marketing and Legal, estimated the monetary impact of each scenario. These impacts were based on similar examples in the public
domain and internal estimates of remediation costs.
The impacts were modelled for both year one and year four of the forecast period to ensure that expected changes in the Group’s product mix,
through migration towards a greater proportion of cloud based products, did not adversely impact on the Group’s viability.
As set out in the Audit and Risk Commiee’s report on page 70, the Directors reviewed and discussed the process undertaken by management,
and also reviewed the results of reverse stress testing performed to provide an illustration of the reduction in revenue that would be required to
break the Group’s covenants or exhaust all available cash.
The Directors’ financial viability statement is contained in the Directors’ Report on page 93.
The Sage Group plc | Annual Report & Accounts 2015 43
FINANCIAL STATEMENTSGOVERNANCESTRATEGIC REPORT