Strategic report
Governance
Financial statements
92 OCU Group Annual report and financial statements 2026
Risks continued
Macroeconomic environment Risk area: Strategic and commercial Potential impact
Business systems Risk area: Operational
Cyber attack Risk area: Operational
People and talent Risk area: Operational
Potential impact Failure or poor integration of critical systems could disrupt delivery, safety reporting, financial control or client service. International growth increases reliance on resilient platforms and consistent data.
Potential impact Evolving cyber threats could disrupt operations, compromise data or critical services, and cause financial, regulatory or reputational harm as digital reliance grows.
Potential impact Failure to recruit, retain or develop skilled people could constrain safe delivery, client service, capability growth and succession as the Group expands internationally.
Geopolitical uncertainty, policy change, inflation and supply constraints may affect client investment, labour and material availability, project timing and margins across the Group’s UK and international markets.
Mitigation Long-term regulated frameworks and project work provide resilience across cycles. Inflation-linked pricing, disciplined contract selection and flexible delivery help manage volatility. Diversification across Power Transmission & Distribution, Energy Transformation, Digital Infrastructure and Water & Environmental markets, clients and the Australia and New Zealand platform is supported by regular forecasting.
Mitigation OCU continues to consolidate operations onto integrated enterprise, workforce and data platforms. Microsoft Dynamics 365, OCU One and the Group Data Platform strengthen control and real-time insight across the workforce and acquisitions. Access, change and continuity controls remain governed through the ISO 27001-certified management system.
Mitigation ISO 27001-certified controls, endpoint and identity protection, vulnerability management and awareness training underpin cyber resilience. A 24/7 Security Operations Centre provides continuous monitoring with specialist partners, while incident response and recovery arrangements are reviewed as international operations expand.
Mitigation The Group’s recruit, deploy, develop and retain model combines in-house recruitment, forward workforce planning and flexible deployment. During FY26, OCU delivered more than 8,000 training days. Seven UK academies, early careers programs, structured development, succession planning and People First initiatives support capability and retention.
Powered by FlippingBook