The starting point for the assessment of risks at Whitbread is the Company’s business model. Risks are linked to each component of the business model as shown in the Risks Linked to Strategy document (PDF, 50kB).

Structure

The structure of the risk management process at Whitbread is shown in the Risk Management Structure (PDF, 13kB). Both Whitbread Hotels & Restaurants and Costa maintain risk matrices aligned to their own business model. These matrices analyse the risks to the achievement of each business’s strategic goals and prioritise those risks as low, medium or high based on both the likelihood and potential impact of each risk. The matrices, together with controls and mitigating actions, are reviewed on a regular basis by the management board of each business.

The outputs of the process carried out by the businesses form the basis of the risk matrix for the Group. The most significant business–level risks are included in the Group risk matrix, together with other risks that are specific to the Group. The Group risk matrix is reviewed on a quarterly basis by the Board and annually by the Audit Committee.

The process:

• links risks to the Group’s business model and strategic objectives;

• analyses risks based on likelihood and potential impact;

• outlines key controls and mitigating actions; and

• ensures that risks and controls are reviewed quarterly and updated as necessary.

The risk and control matrices form the basis of the annual assurance plan, which provides for the independent testing of controls and mitigating actions by Ernst & Young, NSF (an independent health and safety auditing company), the Company’s internal control evaluation process or PwC as part of the operational audit programme.

The current status

In total, there were 21 risks (2012: 18 risks) identified on the Group risk matrix considered by the Audit Committee in March 2013. After taking account of the controls and mitigation plans the Audit Committee and the Board considered that 15 of the risks either had a low likelihood of occurring or a low potential impact. For this reason, these 15 risks have not been categorised as principal risks.

The six principal risks identified, together with details of controls, mitigation and assurance plans are summarised in the Principal Risks (PDF, 69kB). Two of these risks are considered to have a high likelihood of occurring. The first is the risk of a serious food provenance issue, which has increased during the year due to the Europe–wide problems with the processed meat supply chain. This issue has been given significant focus and we have strengthened our testing and traceability regime as a result. The other risk deemed to have a high likelihood is the loss of key employees who have been targeted by recruitment consultants. We have taken action to ensure that our key employees understand the benefits of staying with the Company, both in terms of development opportunities and long–term remuneration benefits.