21
Principal Risk Explanation Mitigating Action Trend
Information security and data
privacy
The Group’s products require the processing of confidential
client data including, for a number of products, material
non-public financial data and personal data. Additionally,
the eSuite product requires processing of client subscriber
personal data including payment card data.
Failure to appropriately protect this data could have
significant financial, regulatory and reputational
consequences for the Group.
Increased risk relates to heightened sensitivity regarding
data security and the emergence of AI technologies, as well
as more sophisticated risks to data security.
The Group has a strong focus on all aspects of information
security – people, processes and technology. The
Information Security function is led by the Information
Security Officer who reports to a Security Committee
comprising of members of senior management and chaired
by the CFO.
Our Information Security Management System (ISMS) is
ISO 27001:2022 certified, and we follow formal processes
for all aspects of information security including building
secure systems to prevent cyber-attacks and protect our
information security assets, monitoring and detecting
threats and responding to the same as well as applying the
required governance and compliance processes.
We also have formal processes for key IS domains including
secure systems build, IT asset management, vulnerability
management, cyber threat management, incident
response, BCP/DR and personnel security management. In
addition to ISO 27001:2022, we also provide SOC reports to
SaaS clients to support client compliance processes as well
as PCI-DSS certification for eSuite clients.
Risks emanating from new risk vectors including our
expansion into new client industry sectors such as
healthcare, global pandemics, cyber warfare, ransomware
attacks, changing regulations, sanctions and changes
in information security frameworks are assessed and
mitigating action plans are formally prepared and
presented. These assessments are regularly reviewed by
the Information Security Committee. The Board is also
provided with regular updates regarding our information
security posture and risks.
For personal data protection, we have formal privacy
and compliance management processes including
privacy risk assessment, secure systems build, GDPR and
CCPA compliance processes, client data categorization,
protection and deletion processes. Where the Group acts
as a processor for client personal data, we work closely
with clients to ensure compliance with privacy laws.
↑
Banking The Group has in place a term loan and revolving credit
facility with Bank of Ireland (see page 117 for details). The
business is reviewing options to refinance the existing
facilities with multiple parties.
Any significant future interest rate changes could impact
the cost of borrowing for the Group. Also, the failure of
banking counterparties may lead to loss of all or part of
cash held with such counterparty.
The Group has in place an interest rate swap to manage
its exposure to changes in interest rates. The Group also
has significant cash balances and seeks to maximise the
interest earned on these (see page 115 for further details).
Day-to-day oversight of the Group’s banking arrangement
is carried out by the Chief Financial Officer and his team.
The team also monitors the ongoing solvency of Bank of
Ireland and other key banking counterparties.
↔
Geopolitical risk The Group has operations in a number of countries and
seeks to mitigate any risks to its employees arising from
conflicts or other geopolitical incidents.
As a result of our geographic spread, the Group is exposed
to a wide range of political, economic, regulatory, social
and tax environments. Policies or laws, involving the
countries in which we operate, may change in a manner
that may be adverse for the Group, even those with stable
political environments.
Risk is increasing due to ongoing conflicts in Ukraine and
middle east, as well as tariff introductions by large trading
blocks.
The Group remains alert to geopolitical risks and has in
place business contingency plans which are overseen by
the Board. These plans are developed on an ongoing basis
in readiness for any need to implement.
The Group has not been directly impacted by any of the
conflicts seen across the globe in 2024. However, the Board
recognises that its employees may be indirectly impacted
and provides support through the People & Culture team.
↑
Environmental, social and
governance
Aptitude is committed to being a responsible business
and operates in a sustainable manner for all of our
stakeholders.
Failure to operate in a way that appropriately manages our
impacts on the environment and our communities may
negatively impact our reputation as a responsible business.
The Board oversees the steps taken by Aptitude to act
responsibly for the environment and our communities.
More information on this is found in the Responsible
Business Report on pages 13 to 15. The Chair of our Audit
Committee, ensures that the Company meets its climate-
related reporting obligations.
↔
The Board’s ongoing review of emerging potential risks has not identified any beyond those detailed in the preceding table. In
undertaking this review of its principal risks, the Board also considered other potential risks and concluded that they were not
considered to be principal risks. The Board, with the support of the Audit Committee, will continue to review potential emerging
risks, and update its principal risks as necessary.
