Key risk drivers:

Lack of opportunities in chosen markets - market sectors do not have a favourable policy of private sector provision of public services, reducing pipeline opportunities.

External factors reducing the pipeline of opportunities - changes such as the Brexit decision may make it more difficult for us to win EU government contracts.

Not accessing opportunities due to inability to qualify - lack of critical skills and references, and a value proposition for the markets in which we compete, may put Serco at a disadvantage with our competitors.

Inability to meet customer and solution requirements during design, implementation and delivery - executing our bids in an unsatisfactory manner by not understanding the strategic needs of the customer, mispricing bids, developing unworkable solutions, and misunderstanding risks, may prevent us from achieving our growth ambitions.

Key risk drivers:

Stakeholders' perception of Serco - a poor perception of Serco may result in an inability to build relationships.

Stakeholders' expectations are not understood - an inability to identify changes in stakeholder expectations may result in the failure of key relationships.

Our ways of working do not align with our Values - staff or third parties being unaware of and/or not reflecting our Values may result in unacceptable business conduct, and unethical or illegal behaviour.

Deliberate breach of law and / or regulations - staff and third parties inappropriately incentivised to behave in a certain manner may result in a breach of laws and regulations.

Direct or indirect contribution to human rights abuse - staff either directly or indirectly contributing to human rights abuses may result in a breach of laws/regulations.

Inappropriate response to an incident - if we do not respond in an honest and collaborative way with key stakeholders, then we may fail to protect our reputation.

Key risk drivers:

Failure to implement on time - either as a result of financial pressures or poor programme management, we do not implement the Group transformation programmes on time.

Non-delivery of required benefits - we fail to achieve the expected benefits due to poor programme management and/or solution design.

Severe disruption to the business - we fail to coordinate and prioritise the various programme activities due to poor integration across activities and inadequate programme management, and we negatively impact on Business As Usual activities.

Lack of staff engagement - due to ineffective communication or the setting of unrealistic or unclear expectations, we fail to gain staff buy-in.

Failure to effect merger and acquisition activities and disposals - we do not identify and effect M&A activities or effect the intended disposals, and fail to achieve the anticipated portfolio and capital position.

Key risk drivers:

Not setting the right tone from the top - if we do not set the right tone from the top, we may fail to embed the finance policy, processes and controls.

Poor financial processes - if processes are poorly designed, then inaccuracies and fraud may occur.

Inadequate financial controls within the business - if controls are inadequate we may fail to provide adequate protection from sabotage of systems, fraud and error.

Inadequate financial controls within Treasury - a lack of a control framework for treasury-related activities may result in insufficient liquidity.

Loss of finance IT systems and critical financial roles - if finance IT systems and roles become unavailable, we will not make financial transactions and meet contractual and reporting obligations.

Impact of Transformation Programme activities - programme activities may lead to an unstable financial control environment due to an increased workload on the finance community.

Failure of Finance Transformation Programme - we do not transform the finance processes and controls, and fail to deliver expected benefits.

Key risk drivers:

Non-compliant systems - if our systems are noncompliant with regulatory requirements for sensitive information, we are susceptible to breaches and penalties.

Non-compliance with policies and standards - if staff do not comply with Serco policies and standards, then they may accidentally release sensitive information to third parties.

Inadequate protection of sensitive information - if we do not identify sensitive information and protect and test the vulnerability of the systems, then we are potentially exposed to a breach.

Inadequate incident monitoring and response - if we do not monitor our systems and remediate and repel attacks, then we may fail to minimise the impact of any breach.

Unauthorised use of systems - if we do not implement effective personnel vetting and access restriction processes and controls, then unauthorised use of our systems may occur.

Poor perception of Serco's capabilities - if we are perceived to be vulnerable to cyber attack, we may lose customer confidence.

Key risk drivers:

Poor culture - if staff do not align with our Values, and are inappropriately incentivised due to operational targets and/or performance incentives, then deliberate misreporting may occur.

Lack of compliance with processes and controls - if staff do not comply with finance processes and financial controls, then deliberate or unintentional misreporting may occur.

Lack of clarity on contract performance obligations - if there is lack of clarity between Serco and the customer on contract performance obligations, then accidental misreporting may occur.

Misunderstanding of performance reporting requirements - if staff are not aware of reporting requirements and are not trained to use systems, then accidental misreporting may occur.

Poor oversight of Joint Venture (JV) systems - if we have insufficient oversight of JV partner systems, and insufficient assurance provided to the JV Board, then we may be unaware of deliberate or accidental misreporting of performance.

Key risk drivers:

Ineffective planning - inadequate planning for management succession may result in a failure to provide sufficient leaders.

Inability to attract people - uncompetitive reward packages may result in failure to attract suitable leaders.

Inability to select people - inadequate selection processes may result in failure to select the right candidate.

Ineffective on-boarding - inadequate on-boarding, in a timely fashion may result in failure to recruit the right candidate.

Inability to retain leaders - inadequate reward reviews and incentives structure may result in failure to motivate our leaders.

Insufficient talent pipeline - if we do not identify skillsets and potential successors, then we may fail to build a talent pipeline.

Lack of leadership capability - if we do not develop leadership capability, then our leaders may not be fit for the future.

Lack of leadership engagement - if we do not effectively engage with our leaders, then we may not retain them.

Key risk drivers:

Lack of capability and experience - if our chosen market sectors are not aligned to our capability and experience, then a failure to operate optimally may result in an event.

Lack of safety cultural alignment - a safety culture which does not reflect our Values and fails to engage our staff may result in an event.

Inadequate policies, standards and procedures - if procedures/systems are not aligned with industry standard or customer expectations, an unacceptable level of safety management may occur.

Insufficient safety management oversight - devolved compliance of regulations to sector-specific SMEs without appropriate safety management oversight may result in safety management systems which are not fit for purpose.

External factors resulting in changes in the contract operational environment - a lack of identification and assessment of external risks may result in poor mitigation of and/or response to an event.

Inadequate response to a catastrophic event - if our contingency plans do not provide an adequate response to an event then escalation of an event or prolonged disruption may occur.

Key risk drivers:

Ineffective and inconsistent bid and contract governance - may result in a lack of understanding of accountabilities and responsibilities.

Non-compliance with Policies and Standards - staff failing to follow required processes, controls and governance may result in contract noncompliance and non-performance.

Lack of visibility of contract compliance and performance - may result in an inability to predict contract non-performance and make timely interventions.

Poor understanding of contract obligations - may result in staff failing to acknowledge and act on obligations.

Lack of service definition and capability to deliver - may result in an inability to deliver contractual obligations.

Contract requirements and pricing too onerous / severe to perform - may result in an inability to meet our contractual obligations.

Set up for failure as contract assets not as expected - lack of due diligence of assets may result in higher than anticipated ongoing costs.

Not learning from prior contract issues - may result in an inability to learn from our failures and successes.

Unforeseen changes in contract assumptions - may result in a misunderstanding/misalignment of our contractual obligations with the customer.

Changes in law/regulations - see Material Legal and Regulatory Failure risk on following page.

Key risk drivers:

Lack of policy and guidance - may result in a failure to manage Group-wide material legal and regulatory requirements.

Staff non-compliance with policies and standards - may result in compliance failures for Group-wide material legal and regulatory requirements.

Failure to identify and keep up to date with all material legal and regulatory requirements - may result in key subject matter experts within the business not remaining up to date and we then fail to comply with material legal and regulatory obligations.

Inadequate assurance processes - may result in an inability to confirm compliance with legal and regulatory requirements.

Lack of legal and regulatory expertise within the business - may result in lack of identification and support of legal and regulatory risks.

Inadequate provision for material legal and regulatory risks in contracts - may result in the failure to provide adequate legal support for material legal and regulatory risks.

Contract exit legal/regulatory requirements not being met - may result in possible legal action and diversion of management attention.

SFO investigation - we remain under investigation by the UK Serious Fraud Office (SFO). In November 2013, the SFO opened an investigation into our Group's Electronic Monitoring Contract. We are cooperating fully with the SFO's investigation but it is not possible to predict the outcome. However, in the event that the SFO decides to prosecute, the range of possible adverse outcomes is any one or a combination of the following:

(i) that the SFO prosecutes the individuals and / or the Serco Group companies involved, who may defend the action successfully or be convicted. This may result in significant financial penalties, an impact on existing contracts and Serco being subject to a period of discretionary debarment from future contracts with UK Government entities; or

(ii) that the SFO and the relevant Serco entities enter into a deferred prosecution agreement (DPA) - which may result in significant financial penalties and a period of discretionary debarment from future contracts with UK Government entities. Such debarment would be discretionary in the sense that a contracting authority may consider it not to be relevant to a given bid or re-bid, or that Serco has provided sufficient evidence that it has addressed any issues identified in a DPA, or be limited in

time under the terms of the Public Contract Regulations 2015.

Upon any such conviction or DPA, the amount of additional work given to the Group may be reduced, and the Group may be subject to enhanced scrutiny with respect to its other contracts and further actions beyond those being implemented under the Corporate Renewal Programme may need to be taken.

If the Group faces any criminal convictions, debarment consequences or enters into a DPA, any such outcome could result in significant fines and have a material adverse impact on the Group's ability to contract with the UK Government and on its reputation, which would, in turn, materially adversely affect its business, financial condition, operations and prospects.

In addition, a criminal conviction of a Serco entity or of one or more of the Group's current or former employees would in certain circumstances allow the Ministry of Justice to re-open the £64.3m settlement agreed and paid in 2013 in respect of certain issues arising under the Electronic Monitoring Contract. In those limited circumstances, the UK Government may seek additional payments from Serco.

We will continue to cooperate with the SFO's investigation.