Risk management continued
Day to day, our enterprise risk
management is about:
• • Identifying negative and positive risk
circumstances
• • Assessing how likely or serious those
risks could be
• • Creating and monitoring a strategy
torespond to those risks
• • Creating value for our shareholders
and other stakeholders
• • Helping our businesses achieve their
objectives by proactively minimising
the risk in their business plans.
Our enterprise risk management
framework helps the Board to identify
risks directly, to own risks that are beyond
the risk tolerance of our operating
companies, and to collate a set of
high-impact – or principal – risks relevant
to our whole Group. In identifying risks,
the Board is supported by our executives
and managers across our business who
are experts in their respective areas – for
example, our cybersecurity specialists
monitor cyberthreats.
BTG’s directors have committed the
organisation to a process of risk
management that is aligned to the
principles of the UK Corporate
Governance Code, the Committee of
Sponsoring Organizations of the
Treadway Commission and the ISO 31000
Integrated Enterprise Risk Management
Framework. Our risk methodologies are
also defined through continued research
and development, and are benchmarked
against international best practice.
Although, through the Audit Committee,
our Board has overall responsibility for
risk – including establishing and
maintaining our risk management
framework and internal control systems,
and setting our risk appetite – everyone at
BTG plays a part in protecting our
business from risk and making the most of
our opportunities.
No matter how diligently we monitor our
environment, risks can appear and
accelerate with little or no warning. We
remain confident that the time, resources
and effort we have invested, and will
continue to invest, in managing risk have
prepared and equipped us to manage
threats effectively. We believe this means
we can provide our business, people and
customers with reasonable assurance of
staying secure, and so continue to benefit
from the opportunities in our sector.
Our three emerging risks
The emerging risks we identified in our
previous reporting – Climate change,
Keeping pace with social change and
Impact of AI – continued to be relevant
in2025/26. Our Board manages and
monitors these risks closely, with
oversight from the Audit Committee.
Climate change
The physical risks related to climate
change continue to be an area of
emerging risk, even though they are not
materially affecting our business in the
short to medium term. (See Task Force
onClimate-related Financial Disclosures
(TCFD) on pages 58 to 67.)
The physical impacts of climate change
are a potential risk to our people and
facilities, and to those of our customers
and suppliers. The broader impact of the
effect of climate change globally could
also be a threat to operations within
theUK.
While we’re working to reduce our
ownimpact on the climate, as a non-
manufacturing business one of the
greatest contributions we can make is
bysupporting our customers to use
technology in a sustainable way –
particularly by optimising their IT products
and services in the cloud. We also work
with our suppliers to make sure they are
considering sustainability effects when
developing products.
The Board’s ESG Committee provides
governance and oversight of climate
change and its related risks and
opportunities. This high-level governance
brings independent oversight to our
targets, progress and strategy. During
2025/26, we continued to develop our
strategy, review risks and ensure
transparency in reporting through CDP.
We were also accepted as a constituent
ofthe FTSE4Good index, and we remain
certified to the ISO 14001 environmental
management system across the business.
In our TCFD-compliant disclosures on
pages 58 to 67, we review the latest
climate science using several scenarios to
understand our climate-related risks and
opportunities and the cost to the business
from these risks. None of these risks or
opportunities is considered material.
Keeping pace with social change
In 2022/23, we identified a second
emerging risk around social change,
which we again reviewed in the second
half of 2025/26 and still consider to be
emerging. Changing generational and
cultural attitudes could affect the way we
work and how we need to respond to our
people. To identify changes, we are
closely monitoring recruitment, the
attrition rate and insights from staff.
Our customer and talent pool might be
limited if we are not seen as a progressive
organisation. Younger people in particular
are looking to engage with companies
that do the right thing when it comes to
being a responsible part of society.
We have long identified that our staff
needmore than just fair pay: they need
opportunities to develop, to work flexibly
and for the business to feel like a cultural
fit. We continue to take steps to meet these
expectations, and to build on the actions
already taken – such as increasing
wellbeing initiatives, creating office spaces
to meet employee needs, introducing
Group-wide personal development plans
for all staff and having regular employee
feedback opportunities. We listen regularly
to our employees through forums, portals
and anonymous routes, although we
encourage a culture of openness.
Generational changes have also brought
more open minds, particularly in relation
to gender, race, religion, sexual
orientation and a desire to treat everyone
equally – as well as to accommodating
and celebrating difference. We already
hold these values at our core, but need
tocontinually monitor and keep pace with
these changes. Not doing so could affect
our ability to attract and retain not only
employees but also customers, when they
too start to reflect new social values and
require their supply chain to do the same.
34 Bytes Technology Group plc
REVIEW OF THE YEAR