Risk and Risk Management

The Board recognises that the appropriate management of risk is key to the delivery of the Group’s strategic objectives.

We actively capitalise on the opportunities impacting our industry to ensure that the Group remains well positioned to deliver on the evolving needs of our customers. Our diversified business model means that we have low operational leverage with no single contract material to the Group. This enables us to take on a level of financial leverage in expanding the business. As a leading international transport company, however, the Group is exposed to an evolving landscape of risks, whether industry-wide or more specific to the Group, which could potentially impact performance or reputation negatively as well as positively.

The Board remains ultimately responsible for the effective management of risk in the Group, and is committed to driving continuous improvement and adopting best practice in this crucial area. In addition to the broad strategic responsibilities of the Board, two or three times annually the Board: 

  • reviews the principal risks faced by the Group and approves the Group Risk Register; 
  • approves the Group Risk Appetite Statement; and 
  • reviews and approves the Group Emerging Risk Register.

The Audit Committee reinforces the process further by conducting ‘deep dive’ reviews, either on specific risks such as cyber security, or through discussions with divisional leadership teams to challenge their divisional risk registers.

Open all  

Close all  

 

Risk management framework

 
The effective management of risk is embedded in many ways in day-to-day management activities, for example the usage of very granular, detailed KPI tracking in monthly divisional reports, or robust due diligence on acquisitions. This is the ‘first line’ of the Group’s risk management structure where internal control and risk management processes are based on the ‘Three Lines Model’, summarised below.
 

Defence

Responsibility

Actions
Oversight Board
  • Sets strategic objectives
  • Determines overall risk culture and appetite 
  • Establishes organisational structure with defined lines of responsibility, delegated authorities and clear operating processes 
  • Reviews and approves Group Risk Register, Risk Appetite Statement and Emerging Risk Register, two or three times annually 
Audit Committee
  • Conducts ‘deep dive’ reviews of divisional risk registers, or specific Group risks
Third line Group internal audit
  • Provides reasonable assurance that systems of risk management, internal control and governance are effective
Second line

Group Executive Committee

Group functions including Risk
  • Support divisions with ‘first line’ responsibilities 
  • Coordinate and report on Group-level risks 
  • Build risk capability and understanding
First line

Divisional Executive Committees

Divisional management
  • Identify, assess and report key risks
  • Regularly review and update divisional risk registers
  • Implement risk mitigation plans

Risk Appetite

 

The Board recognises that continuing to deliver superior returns for shareholders and other stakeholders is dependent upon accepting a level of risk. Our risk appetite sets out how we balance risk and opportunity in pursuit of our strategic objectives.
 

Zero Tolerance

The Group has zero tolerance for risk which may impact:

  • The safety of our employees, customers or the general public
  • Our reputation and brand; and/or
  • Our legal and regulatory compliance

Core business / Operational Excellence

Technology

Strategic Growth / M&A

The Group has low tolerance for risk in its core operations.

The Group accepts a moderate level of risk in investing in and adopting technologies that will enhance customer service or improve operational and safety performance.

The Group accepts a moderate level of risk in pursuing new opportunities, including potential new markets.

Principal risks and uncertainties