OCU Group - Annual Report 2025

Strategic report

OCU Group | Annual report and financial statements 2025

Governance

Financial statements

Ensuring excellent business standards Governance

Robust compliance regime

Effective risk management

Integration of Nettworx and Modus operations: Successfully aligned Nettworx and Modus businesses under OCU Group’s certified management system framework, ensuring consistency in compliance and governance standards. Continued achievement and maintenance of ISO certifications: Maintained key ISO standards (ISO 9001, ISO 14001, ISO 45001, ISO 27001), reinforcing our commitment to quality, environmental stewardship, safety, and information security excellence. Enhancements to OCU One platform: Improvements to our centralised management system increased the accessibility, transparency, and efficiency of compliance processes across the Group. These achievements reflect tangible progress in strengthening the foundations of operational excellence and proactive compliance management. Goals for the next financial year • Implementation of a new Learning Management System (LMS): We will introduce an LMS to enhance the management, delivery, and tracking of compliance training across the organisation. • Strengthening compliance training programs: Rollout of tailored, Group‑wide compliance training to ensure consistent standards and reinforce a culture of continuous improvement. • Sustained focus on certification excellence: Maintain and extend ISO certifications across the expanded OCU Group businesses, embedding best practice.

Business Continuity and Emergency Response Framework established and trained: Developed and implemented Group‑wide procedures to enhance preparedness and resilience to potential disruptions. Delivered training to senior leadership, building the internal capability to respond effectively to emergencies. Data security testing through simulated phishing email campaigns: Conducted proactive testing to raise awareness, identify risk areas and strengthen defences against cyber threats. Transition to ISO 27001:2022 Standard: Successfully upgraded from the 2013 to the 2022 Information Security Management System standard, reflecting our commitment to evolving best practices. Implementation of Group Risk Committee: Established a dedicated committee of key stakeholders to enhance strategic oversight and review of enterprise risks. Top six business safety risks identified: Undertook a detailed analysis to identify and prioritise the six highest safety risks impacting the business, enabling sharper focus on mitigation strategies. Goals for the next financial year Digital risk management platform implementation: Introduce a new digital platform for Facilities Management (FM) to enhance risk monitoring, management, and reporting. Build out compliance function: Create a compliance team under the leadership of a Head of Compliance; this is a new role to be introduced in FY26.

Overview At OCU Group, maintaining a robust and forward-looking compliance regime remains central to supporting our long-term success and sustainable growth. Through our Integrated Management System (IMS), we have further strengthened governance across the business by empowering functional owners with clear accountability for compliance delivery. This collaborative approach has enhanced operational ownership and increased the system’s resilience. Over the past year, we successfully integrated our acquired Nettworx and Modus operations under our existing management system and certification framework. We continued to uphold and achieve key external accreditations, maintaining certifications to leading ISO standards which reinforce our commitment to the highest standards of governance, risk management, and sustainable business practice. Enhancements were also made to OCU One, our digital management platform, further improving the accessibility, efficiency, and transparency of compliance processes across the Group. Key achievements Strengthening the IMS with functional owners: Clear accountability for compliance was established across key operational areas, enhancing system ownership and operational resilience.

Overview Effective risk management remains essential to ensuring the Group’s financial stability, regulatory compliance, operational resilience, and long‑term sustainability. OCU Group continues to strengthen its comprehensive risk management framework, embedding a structured, proactive approach to identifying, assessing, and mitigating risks across all business activities. Oversight of risk management is provided through the Group Board, primarily via the Audit & Risk Committee and the newly formed Group Risk Committee, ensuring strategic alignment and rigorous governance across all operational risk areas.

Key achievements National Operations Centre (NOC) development and implementation:

Successfully launched the NOC to strengthen operational control and real-time risk response. The response team in Leeds are now managing over 13,000 contacts each month and have become an integral part of workforce operations. Examples of activity include supporting client and customer enquiries, scheduling new jobs, and co-ordinating emergency response requests. The NOC is staffed by trained Response Coordinators, not standard call handlers, who prioritise incidents according to client‑defined SLAs. The team can be reached via multiple channels, including phone, email, and client‑specific emergency forms, ensuring ease of access and flexibility. Communication methods are agreed in advance with each client to align with their operational needs.