Regulation continues to increase within the markets we operate. Legislation changes on a regular basis and the interpretation of existing laws can also change, creating ever-tightening standards. This will often require additional human and financial resources and the provision of new assets and systems.

We are committed to responding positively to regulatory change to ensure compliance, as this could affect the pricing for, or adversely affect the revenue from, the services the Group offers or cause reputational issues.

We also acknowledge that we are required to maintain a number of accreditations and registrations to meet a number of contractual and statutory obligations.

We are aware of increasing international regulation for data processing and privacy in the geographies in which we operate.

We have dedicated Legal, Governance, Health and Safety, Privacy & Information Security Teams who are collectively responsible for monitoring changes to legislation and ensuring compliance in each area. We continue to invest and have increased the number and skills levels of the respective teams in the past year. The strength of the management team has been augmented by the appointment, during the year, of a Chief Regulation Officer ("CRO") with risk management experience.

We have established procedures which we invoke when presented by material issues and changes (such as Covid-19, Brexit and regulatory challenge), which involves: bringing together a senior team; assessing the issue and scoping a plan of action; assigning activities and monitoring progress and developments. There is also an established process for keeping the Board informed and escalating matters.  

We have access to an extensive and global range of external professional advisors.

We have a Group-wide intranet through which we advise, train and provide ongoing development to all of our team members, globally, about our policies. This provides us with the means to ensure (and demonstrate) ongoing compliance with regulatory obligations including those required under data protection and privacy legislation. Our monitoring processes allow us to ensure that all team members undertake the necessary training and we can present the evidence to regulators and customers where needed.

GBG is committed to continued investment in training team members in relation to data handling and privacy best practices.

During this pandemic our priorities have been to protect our team members and to support their health and wellbeing, to look after our customers and to secure our business both financially and operationally.

Covid-19 has led to additional legislation in the jurisdictions in which we operate, covering health and safety, finance and governance. There are various work streams within our Covid Team which consider changes in legislation and guidance, in conjunction with our professional advisors. This ensures that we have assimilated information to understand and comply with the requirements. This focus will be maintained as lockdown restrictions are eased globally and governments implement further initiatives to support their citizens and economies.

As reported in previous periods, in November 2018 The Information Commissioner's Office, the data industry regulator in the UK, announced that it was conducting audits on a number of companies to understand the use of data in their services. GBG was included in this review and continues to engage positively with the Commissioner as part of that review. We will keep the market informed of any material developments. 

We work closely with our tax advisors to ensure we comply with international regulations that are appropriate for the Group but not to take positions that are open to challenge and/or misinterpretation.

Our markets continue to be increasingly competitive and intensified competition could lead to pricing pressures.

A reduction in the rate at which we add, grow and retain customers may decrease the size of our market share if customers choose to receive services from other providers.

Our business development and product functions track the activities of both our long established and market disruptor competitors. This insight is used by management to quickly adapt our go-to-market strategy.

We always seek to differentiate ourselves from the competition and have increased our focus on data sourcing, product innovations, product marketing and pricing to support this.  

We continue to enhance our product portfolio and focus on innovation through a mix of internal development; partnering; acquisition and investment; and strategic recruitment.

We maintain a strong focus on our core target markets within Europe, North America and APAC and work with partners to extend our reach in our chosen verticals.

Our acquisition strategy has opened up new markets and territories enabling cross selling, as well as leveraging opportunities to increase the size of our customer base within established markets. We remain vigilant to future acquisition opportunities to further develop our strategic aims. 

We have increased focus on our core strengths of location, identity and fraud and have exited businesses (such as marketing services and employee onboarding) that do not add to these strengths. In our core business we have increased focus on product development, both organically and inorganically, such as with the acquisition of HooYu Investigate in December 2020.

Some of our data and infrastructure is sourced from third party suppliers and partners. The removal from the market by one or more of these third-party suppliers or interruptions in supply could quickly and adversely affect our operations and result in the loss of revenue and/or additional expenditure.

Our Product, Data and Technology teams work strategically to prevent over reliance on any one key supplier, having multiple suppliers and other such mitigations where required.

Suppliers are carefully selected to minimise risk of supplier failure or insolvency.

We ensure our team members are aware of supplier requirements or restrictions, to minimise the risk of loss of a supplier, due to a breach of contractual obligations.

In support of our work undertaken prior to the pandemic, as part of our Covid-19 business continuity plan ("BCP") process, we conducted more immediate risk assessments and checks of our key suppliers' BCPs to assess their preparedness and ability to meet GBG's ongoing requirements during the pandemic.

This list was prioritised to deal with our most critical suppliers initially and work then continued during the period to assess those suppliers further down the priority. This review process now forms part of the onboarding of new suppliers.

The nature of our business means the threat of unauthorised or malicious attacks on our IT systems is an ongoing risk. The risk of a cyber-attack (such as denial of service attacks, phishing, data theft and disruptive software campaigns) is constantly evolving and becoming increasingly sophisticated.

Cyber risk continues to be an ever-increasing threat and the Group's strategy ensures continuing improvements in developing, maturing and testing our defences.

Natalie Gammon, GBG's Non-Executive director with a specific technology background, meets the Chief Technical Officer and Chief Information Security Officer regularly. In addition, they provide the Board and Audit & Risk Committee with regular updates and progress reports on our information security plans and strategy through written reports in Board packs and in-person updates at Audit & Risk Committee and Board meetings. 

We have cyber insurance in place and have policies established and monitored by our Chief Information Security Officer to protect the Group against a cyber-attack and any security breaches in this area.

The Group's Information Security ("InfoSec") capability has been strengthened during the year as part of our ongoing cyber strategy, providing additional support and expertise.

We continue to develop our InfoSec awareness programme with all of our team members to raise the knowledge of cyber risk and information security. We use our global intranet training programme to ensure that all team members undergo training and development on cyber threats and good IT business practices.

Penetration testing is conducted via an approved third-party specialist.

GBG has been diligent in maintaining the scope of review and monitoring of cyber threats. We are keenly aware of the increase during Covid-19 of phishing and fraud attempts and have dealt with these issues proactively including awareness campaigns to update all of our team members to supplement prior training given.

We have an understandable reliance on our IT systems and people. In the event of an incident affecting business continuity, we would initiate our business continuity plans. However, the loss of key components as a result of the incident could affect the Group's operations and result in additional expenditure.

Our global business continuity programme covers policies and procedures for the key components of each of the Group's operating units. During the 2021 financial year, the Group completed a comprehensive review of our business continuity programme to ensure that the programme continues to meet the needs of the Group, as we continue to grow in size, diversity and complexity.  

Disaster recovery requirements and network security are regularly reviewed, back-ups are maintained in databases and data centres have off-site provisions. These policies and programmes are subject to annual review and audit.

We engage and undertake due diligence with our data partners and suppliers to ensure vulnerabilities are identified and mitigated.

For risk analysis and mitigation processes relating to products and services that we either provide or consume. We feed these into a risk matrix where we track treatment plans against each risk.

As part of our increased monitoring of this risk area, the Covid Team receives weekly reports on usage volumes of all of our services together with network service availability updates. This data has been provided throughout the period to identify trends and to support our activities.

We invest significant amounts of resource into our product development in order to maintain a competitive advantage.

The development of all new technologies and products involves risk, including the product being more expensive, or taking longer to develop than originally planned. The market for the product may be smaller than originally envisaged or the product may fail to reach the production stage.

It is also imperative that our developments have the ability to scale as the business grows both in size and complexity.

We carry out extensive research and market analysis around the viability of a product before the development phase is initiated and have increased the involvement of customers throughout the process.

We have increased the investment in our product development teams, ensuring that development meets both tactical and strategic business objectives. We continuously improve our development skills, processes and platforms to ensure that GBG adopts best practice and can address, at pace, potential challenges and opportunities.

We have invested in improvements in methods, tools and skills in our product and technology teams to reinforce best practice development approaches.

We have increased our focus on product retirement, as part of our Product Lifecycle Management approach, to ensure our development resources are focused on the activities that drive growth.

We are investing in modernisation of our customer-facing platforms to enable greater scale and reach. In FY21 these developments included the front-end platforms for location and fraud the back-end platform for identity and plans are in hand to extend this investment in FY22. As well as improving our product platforms, we are investing in business support systems and have established a new team to drive automation and other improvements that help the business scale.

We protect our proprietary application software products and services by licensing rights to use the applications rather than selling or licensing the computer source code. 

In addition to verifying and auditing our customers' use of GBG's intellectual property, we also rely on trademark, copyright, patent and other intellectual property laws to establish and protect our proprietary rights in these products and services.  However, there is a risk that our proprietary rights could be challenged, limited, invalidated or circumvented.

All of our contracts include provisions to protect the proprietary rights of the Group. GBG's legal function also ensures that such rights are secured and protected during any negotiation with customers or suppliers. 

Where appropriate, we register trademarks globally and work closely with external advisors to ensure that our business rights are safeguarded in all the territories in which we operate.

GBG has also invested in increasing resources to improve how proactively we conduct audits of customer compliance with licensing obligations and successfully enforce our rights.

Our people are key to our success. We operate in very competitive markets and acknowledge that the skills that our people possess are attractive to other employers. There is the risk that not having the right people and skills could impact negatively on our ability to serve our customers and grow the business.

It is important that we maintain high levels of employee engagement to ensure that we are able to retain and attract the best talent.

We are very mindful that we operate in a highly competitive talent market. As a result we have ensured especially during the pandemic, that we continue to provide high levels of support and consideration to our team members' wellbeing and ongoing development. In light of Covid-19, the Board and the Remuneration Committee have also discussed a range of proposals and potential actions to support these initiatives, in order to maintain our ability to retain and attract talent needed by the business.

We invest in developing the skills and abilities of our people across all our locations and geographies.

We offer competitive total benefits packages (compensation and benefits) and these are reviewed and benchmarked regularly.

Employee engagement is monitored formally every six months through a Group-wide survey and the results are used to focus on improvement activities. This survey has continued during the Covid-19 pandemic.

We monitor attrition rates by business function and location in order to identify issues and prioritise restorative action where necessary.

We strongly believe that diversity throughout the Group is a driver of success and recognise it has significant benefits. We have taken a number of proactive steps to promote diversity and equality within GBG under our Group-wide initiative, be/yourself. Launched over three years ago this initiative supports a range of activities in our focus areas of: nationality, race & religion; sexual identities; experience & age as well as addressing gender imbalances in our business, our industry and our communities.

We also monitor the effectiveness and skill set of the Board and recruit additional members where necessary. This enables effective succession, to supplement the Board's skill set as well as maintaining a strong independent director.