Potential impact of failure:

• Poor investment decisions leading to inadequate returns

• Reduced business opportunity and loss of reputation, customers, market share, revenue and profit

• Specialist capabilities eroded through commoditisation

• Reduction in anticipated acquisition value through overpayment, non-delivery of synergies and/or economies of scale and senior management focus diverted away from delivering "business as usual".

Mitigations (examples):

• Challenges in the UK defence market offset by expansion into targeted overseas regions exhibiting long-term growth characteristics

• The market-facing segment strategies enable Ultra to utilise the capabilities of its businesses more effectively to deliver enhanced solutions to its customers

• The LAUNCH approach to customer engagement ensures Ultra understands the real needs of its customers

• Following an audit conducted by PwC on Ultra's bid process and long-term project management, the Group has revised its internal bid and contract management policies to ensure that bids are submitted and won at acceptable margin levels and risk tolerances and contracts are effectively executed

• The Board conducts a rigorous review of acquisition opportunities including commissioning third-party market reports and due diligence. Post-acquisition reviews are performed on all acquisitions comprising integration effectiveness, operational performance compared to expectation and lessons learned. In 2016, the Board received quarterly reports on the Ultra Electronics Herley integration plan.

Potential impact of failure:

• Expected benefits of change not realised

• Significant increase in change programme costs

• Senior management distraction from business as usual

• Reduction in employee morale

• Disruption to business performance.

Mitigations (examples):

• A "deep dive" review of this principal risk

in 2017

• An Executive Team sponsor is allocated to all major change programmes, which are also monitored on a monthly basis by the Board

• In 2016, PwC undertook a risk review of S3. The recommendations from this review are being considered for implementation

• An S3 steering committee, chaired by the Chief Executive, meets monthly to track progress against the plan

• An S3 communications manager is being recruited with responsibility for implementing the communications strategy approved by the S3 steering committee.

Potential impact of failure:

• Not recruiting and retaining the right employees in the right roles would result in Ultra being unable to fulfil its contractual obligations and lead to operational inefficiencies and loss of productivity

• Staff morale could be impaired resulting in a rise of employee related issues (e.g. grievances and sickness)

• Not maintaining a strong ethical culture would increase the Group's exposure to legal and regulatory breaches.

Mitigations (examples):

• Ultra is engaged in a number of initiatives with local schools, colleges and universities which provide access to the best people for its apprenticeship and graduate recruitment programmes. Employee development needs are identified during the performance and development reviews and future development is aligned with these specific needs

• The annual Organisation, Succession & Development Plan (OSDP) results in high potential employees being identified and their development monitored. The establishment of the 'Chief Executive's Mentoring Club' has enhanced this process.

• Employee engagement and morale is measured through YOURviews surveys. The survey identifies any areas of concern which are then addressed by the businesses' leadership teams

• Talent and succession planning has been, and will continue to be, a focus for the Board (see page 50).

Potential impact of failure:

• Reduced product differentiation caused by loss of intellectual property

• Reputational damage to Ultra as a highly regarded provider of secure data systems

• Loss of business opportunity with removal of government approval to work on classified programmes

• Disruption to business activity as systems are cleansed and restored.

Mitigations (examples):

• Continued investment in Ultra's Cyber Protection Group (CPG) (now part of CORVID Protect), which provides Group-wide monitoring, incident

response and continued enhancement of Ultra's IT systems and processes

• Board is kept updated on CPG's developments on protecting Ultra's network, including protecting Ultra from phishing attacks

• The Group's Information Security Policy has been updated

• Protection of intellectual property was addressed in the bid and contract management review (see page 38)

• Security clearance processes in place for all employees

• Established physical security processes implemented at all sites.

Potential impact of failure:

• Failure to deliver against customer commitments

• Reduced profit margins and increased contractual disputes and litigation

• Loss of reputation and investor confidence.

Mitigations (examples):

• The Bid Management Policy has been updated to ensure any major supplier issues and risks (including single-source arrangements) are highlighted and mitigated against, prior to customer contracts being accepted

• The Board has adopted an Anti-Slavery and Human Trafficking Statement in compliance with the Modern Slavery Act 2015 (www.ultra-electronics.com/investors/antislavery-and-human-trafficking-policy.aspx)

• Pre-contract audits of key suppliers and subcontractors and continuing review of their performance

• Business continuity and IT disaster recovery plans are in place

• S3 improvements to the supply chain process

• Business interruption, property damage, professional indemnity and product liability insurance.

Potential impact of failure:

• Significant financial loss (e.g. fraud, theft, material errors)

• Loss of reputation and investor confidence

• Loss of business opportunity with removal of government approval to work on classified programmes.

Mitigations (examples):

• The Group Operating Manual and Risk Management Framework provides clear instructions on the Group's internal governance and controls

• The businesses provide year end disclosures on the effectiveness of their accounting and internal control systems

• Internal Audit conducts an audit of the Group's internal control system

• The terms of reference for the Board and committees are reviewed and updated annually.

Potential impact of failure:

• Any increase in the deficit may require additional cash contributions and therefore reduce the available cash for the Group.

Mitigations (examples):

• Group's UK defined benefit pension scheme was closed to future accrual with effect from 5 April 2016

• The Company agreed the pension triennial valuation in 2016

• The Pension Trustees and Company actively consider pension risk reduction activities such as liability matching, dynamic de-risking, pension increase exchange and retirement transfer options

• The Pension Trustees and Company agreed to increased hedging of the scheme's liabilities in 2016

• The Board undertakes regular Pension Strategy Reviews.

Potential impact of failure:

• Failure to comply with legislation and regulations could result in fines and penalties and/or the debarment of the Group from government contracts

• Reduced access to export markets could have a material adverse effect on the Group's future revenue and profit

• Loss of reputation and investor confidence.

Mitigations (examples):

• The Group Operating Manual has well-established and regularly updated policies and procedures covering legislative and regulatory requirements and compliance training. Individual businesses are required to provide compliance statements as part of their monthly business performance reports

• The Ethics Overview Committee provides independent advice and scrutiny of Ultra's business activity and provides assurance that the Group's current and planned undertakings are transparent and conducted in a manner consistent with the legislative environment

• Employees have access to a Group-wide confidential hotline to report anonymously any concerns they may have about possible improprieties and other compliance issues

• The Company has taken steps to ensure it is compliant with the Modern Slavery Act 2015

• The Board receives regular updates and presentations on the Company's legal and regulatory requirements

• A working group has been established to evaluate the impact of the General Data Protection Regulation and to ensure Ultra is compliant with its obligations.

Potential impact of failure:

• Incidents may occur which could result in harm to employees and/or visitors, the temporary shutdown of facilities or other business disruption

• The Group may be exposed to regulatory action and financial loss

• Loss of reputation and investor confidence.

Mitigations (examples):

• The Board has a low appetite for HS&E risk and is committed to ensuring that the Group's leadership see this as a top priority. Any material incidents are reported to the Board along with a correction/mitigation plan

• The Board undertakes an annual review of HS&E and the Executive Team reviews HS&E on a quarterly basis. Each business conducts an annual HS&E self-assessment in addition to a biannual external audit.