The Risk Management Framework

Ocado's risk management process is designed to improve the likelihood of delivering our business objectives, protect the interests of our key stakeholders, enhance the quality of our decision-making, and assist in the safeguarding of our assets, including people, finances, property and reputation.

The Board is responsible for the review and approval of the risk management framework and for the identification of Ocado's key strategic and emerging risks. The Audit Committee, delegated by the Board, is responsible for the review of the effectiveness of risk management, the system of internal control, and the monitoring of the quality of financial statements and consideration of any findings reported by the auditor, Deloitte LLP, in relation to Ocado's control environment and its financial reporting procedures. The review covers all significant controls including financial, operational, compliance controls, and risk management systems.

The key features of our system of internal control and risk management, including those relating to the financial reporting process, are:

  • an organisational structure with clear segregation of duties, control and authority, and a framework of policies covering all key areas;
  • a system of financial reporting, business planning and forecasting processes;
  • a capital approval policy that controls Ocado's capital expenditure and a post-completion review process for significant projects;
  • monitoring the progress of major projects by management, the Executive Directors and the Board;
  • an executive Risk Committee and a Governance, Risk and Compliance team which monitor Ocado's risks;
  • an Information Security Committee and an Information Security team which monitor Ocado's information security;
  • a Personal Data Steering Committee and data protection team that support data privacy governance;
  • an Internal Audit function that provides independent assurance on key programmes and controls;
  • a treasury policy overseen by a Treasury Committee that manages Ocado's cash and deposits, investments, foreign exchange and interest rates, so as to ensure liquidity and minimise financial risk;
  • a food and product technology department, responsible for designing and monitoring compliance with Ocado's processes for the procurement and handling of foods and other goods for resale; and
  • other control measures outlined elsewhere in this Annual Report including legal and regulatory compliance and health and safety compliance.


Ocado Risk Management Process

The Ocado risk management process is designed to identify key risks and to provide assurance that these risks are understood and managed in line with the agreed risk appetite. The risk appetite is reviewed by the Board as part of its annual strategy review. The risk management process is aligned to our strategy and each principal risk and uncertainty is considered in the context of how it relates to the achievement of the Group's strategic objectives.

The Risk Committee reviews an overall risk report twice a year and this is in turn discussed by the Audit Committee and the Board. The risk report captures the most significant risks faced by the business and identifies the potential impact and likelihood at both inherent level (before consideration of mitigating controls) and a residual level (after consideration of mitigating controls). The appetite for each key risk is also discussed and assessed with a target risk position agreed to reflect the level of risk that the business is willing to accept. This process for identifying, evaluating and managing the principal risks faced by the Group operated during the period and up to the date of this Annual Report. Such a system can only provide reasonable, and not absolute, assurance, as it is designed to manage rather than eliminate the risk of failure to achieve business objectives.

For further information on the review of financial reporting, refer to the Audit Committee report.

Principal Risks

The principal and emerging risks are discussed and monitored throughout the year to identify changes to the risk landscape. The Board carried out its assessment of principal risks and uncertainties towards the end of the period. Set out overleaf are details of the principal risks and uncertainties for the Group and the key mitigating activities used to address them. The risks have been listed against the most relevant Group strategic objectives and are not set out in any order of priority or importance. The inherent (or pre-mitigation) risk movement from prior year for each principal risk and uncertainty has been assessed and is presented (per the key below). For further information on the financial risks, see note 4.8 in the notes to the financial statements.

Brexit impact on the Group

The Group is monitoring closely the legal and political developments in the process towards the UK’s exit from the EU (“Brexit”). A Brexit readiness committee was established in 2018, to prepare the Group for the post-Brexit economic arrangements. The absence of an agreed and binding post-Brexit trade arrangement with the EU, this close to 29 March 2019, means that Brexit remains a principal risk for the Group. The Group has considered the impact in a number of areas:


  • The Group has a dedicated and talented workforce, a substantial number of whom are EEA nationals in many different business areas.  The ability of these employees to continue to live and work in the UK is of critical importance.
  • Our technology division has several software development centres in the EU who work closely with their UK based colleagues. The efficiency of this arrangement could be impacted if post-Brexit there are restrictions on the ability of UK and EEA nationals to travel and to relocate between the UK and EU.

Supply Chain

  • The UK imports about 30% of its food from the EU and the Group does not differ significantly from this average. Our supply chains have been developed as part of this established system, allowing for wide product choice, short ordering times and low inventories. If import tariffs are introduced, cost prices will increase and, if border checks cause disruption, certain short-life products could be unavailable or delisted. Although the Group can and will create buffers of certain critical products, it is not possible to do this for fresh and short-life perishables.
  • Ocado Solutions exports UK-produced technology and equipment to our partners in the EU. Any tariffs or other trade barriers may reduce our competitiveness.


  • A significant proportion of the components in the automation, warehouse, delivery and maintenance equipment used in Ocado’s operations are imported from the EU.  The Group has placed advance orders for spare parts as a buffer against supply disruption.
  • The Group is closely involved in a number of EU collaborations in research and development. Whilst the EU funding is important, access to EU-based academic skills, knowledge and collaboration is more important. Existing funding is expected to continue, however it is unlikely that there would be further or new funding.
  • Ocado Solutions technology and engineering teams are designing equipment for our UK and international partners. This meets current EU requirements and can be certified as such in the UK. This design process could be impacted if UK certification is no longer recognised or there is a divergence between UK and EU standards.

The Group has engaged with suppliers, partners and external advisers to explore solutions to these risks to its business. Aside from considering the impact of Brexit on its operations and business model, the Board gave consideration to Brexit in the context of reviewing its viability and going concern, as noted below. The Company also considered the impact of Brexit as part of its post balance sheet events review process and did not identify any adjusting events.

The Ocado risk management process is designed to identify key risks and to provide assurance that these risks are understood and managed in line with the agreed risk appetite.

Robert Cooper
Chief Compliance Officer

Ocado Risk Management Process

Ocado Risk Management Process

1Our strategy informs the setting of objectives across the business and is widely communicated.

2Executive Directors evaluate the most significant strategic risks for the Group. In addition, each divisional director or selected department head prepares a risk register for their respective division, highlighting their significant risks. The Risk Committee oversees risk control processes and risk analysis from each part of the business, and reviews these top down and bottom up representations to ensure that no significant risks have been omitted.

3Divisional directors or department heads identify how they will manage, and accept or mitigate, their significant risks. These actions are then summarised into a description of the Group-wide mitigation process for each risk.

4Group-wide risks and mitigation processes are regularly reviewed by the Risk Committee and by the Audit Committee.

Driving Growth Icon

Driving Growth

Mitigation Action/Control

  • Weekly monitoring of the key indicators and the underlying drivers against targets.
  • Continuing initiatives intended to improve resiliency and operational performance of the Hatfield and Dordon CFCs. There are ongoing plans to make the scaling of operations at Erith and Andover smoother. These arrangements help reduce the impact of operational problems in CFCs on customer service levels.

Change During the Year

The risk has decreased because CFC capacity at both Erith and Andover continues to increase.

Mitigation Action/Control

  • Continuation of LPP basket matching price comparison and competitive pricing.
  • Growth of the Ocado own-label range alongside continued provision of the Waitrose range.
  • Growth of branded ranges and expansion of supplier base.
  • Alternative sourcing scenarios and other arrangements are planned in the event that the Waitrose sourcing relationship is not renewed.
  • Continuation of investment and optimisation of the marketing channels to acquire new customers.
  • Continued improvement of webshop and apps.

Change During the Year

This risk has increased because competitive pressure remains high and the Group is moving closer to the expiry of the current sourcing arrangements.

Mitigation Action/Control

  • Increased hiring of staff both in UK and overseas.
  • Review of team structures and creation of new key management roles and processes to position the Group for delivering a larger number of complex projects.
  • Increased hiring of managers and subject matter experts in retail, operational and central support areas.

Change During the Year

The risk has increased during the period because the Group needs to deliver more large-scale and complex projects and it is now broader, in that it applies to developing sufficient engineering capability.

Mitigation Action/Control

  • Dedicating resources to the modularisation of technology and logistics systems to enable faster replication.
  • New capacity continues to increase as the Andover CFC and Erith CFC develop.
  • Regular steering meetings and management oversight for new CFC projects.

Change During the Year

This risk has decreased during the period because both the Andover and Erith CFCs have continued to increase capacity.

Maximising Efficiency

Maximising Efficiency

Mitigation Action/Control

  • Regular review of IT prioritisation process and rate of software development and regular platform steering meetings.
  • Resources and capabilities will be scaled and reallocated to help meet Ocado Solutions project deadlines. A new role of Group Transformation Director was created to prepare and help execute a detailed plan to ensure timely and coordinated scaling of operations.
  • There is an ongoing programme of design improvements for the platform.
  • The amount of capital invested in our platform is carefully controlled and we have the ability to reduce costs by scaling back the speed of the development.

Change During the Year

Utilising Proprietory Knowledge

Utilising Proprietary Knowledge

Mitigation Action/Control

  • Engagement with a wide number of international grocers to understand market needs.
  • Experienced teams in place who understand the current solutions and are aware of global alternatives used in other industries.

Change During the Year

This risk has increased because the rate of innovation of MHE, robotics and technology solutions in the grocery e-commerce market is increasing, creating a more competitive market for the Ocado Solutions offer.

Mitigation Action/Control

  • Ongoing effort to identify patentable inventions and to apply for patents, with an increased number of patent applications. Expansion of IP team to help with IP protection work.
  • Ongoing review of our patent portfolio and discussion of other IP issues by the Ocado Innovation Committee.
  • Where necessary we take steps to protect our IP from unauthorised use.

Change During the Year

Mitigation Action/Control

  • Conducting "freedom to operate" searches on selected technologies in selected jurisdictions and monitoring IP filings by a large number of companies.
  • Where appropriate, obtaining specialist or legal advice including to help ensure our ability to use our IP is not restricted by infringement claims.

Change During the Year

Operational Icon


Mitigation Action/Control

  • Experienced legal, food and product technology professionals monitor compliance against policies and procedures.
  • Supplier approval and certification process.
  • Food and product safety policies and quality management with operational procedures.

Change During the Year

Mitigation Action/Control

  • Regular monitoring of regulatory developments to ensure that changes are identified.
  • Some due diligence carried out at appropriate stages in the Ocado Solutions process.

Change During the Year

Mitigation Action/Control

  • Regular monitoring of government reporting on Brexit negotiations to understand impact on the business including our ability to hire employees from the EU, an assessment of trade tariffs on imported goods and impact of disharmonisation of UK and EU regulatory standards in a range of areas.
  • We are taking a range of steps to mitigate the impact of Brexit on the Group including for supply of products and materials and for changes to regulation.

Change During the Year

Lack of clarity on any post Brexit trade arrangements as the exit date approaches increases the risk and uncertainty on the extent to which our operations and performance will be impacted by Brexit.

Mitigation Action/Control

  • IT systems are structured to operate reliably and securely. The security of our IT systems is regularly tested by third parties.
  • An information security governance programme is helping increase security and privacy internal controls.
  • No customer payment card data is held in Ocado's databases.
  • A new Data Protection Officer was hired to oversee the Group's GDPR compliance programme.

Change During the Year

The overall information security risk exposure has increased during the period largely as a result of an increasing external threat environment, the new General Data Protection Regulations and the increasing overall profile of the Group.

Mitigation Action/Control

  • IT systems are structured to operate reliably and securely.
  • Dedicated engineering teams on site with daily maintenance programmes to support the continued operation of equipment.
  • Disaster recovery testing and business continuity plans continue to be progressed and updated.
  • High level of protection for CFCs and equipment, combined with business interruption insurance to transfer residual risks.

Change During the Year

  1. The risk described in the 2017 Annual Report as "Failure to develop retail proposition to appeal to broader customer base and sustain growth rates" has been expanded to reflect the end of the current Waitrose sourcing agreement in 2020.
  2. The risk described in the 2017 Annual Report as "Risk of not signing multiple Ocado Solutions deals in the medium term" is no longer considered a principal risk. Since November 2017 Ocado has signed partnership agreements with four major international grocers.
  3. The risk described in the 2017 Annual Report as "Risk of not being able to executive effectively" has been revised to reflect a failure to deliver key projects effectively and efficiently that could result in significantly increased costs and impede Ocado's ability to execute strategic plans.


risk increase

risk decrease

risk no-change

risk not-applicable

Assessment of the Group's Prospects

The Directors have assessed the Group's prospects, both as a going concern and its longer term viability. This assessment informs the following distinct statements:

  1. The Directors considered it appropriate to adopt the going concern basis of accounting in the preparation of the Company's and the Group's financial statements.
  2. The Directors have a reasonable expectation that the Company and the Group will be able to continue in operation and meet its liabilities as they fall due over the period of their assessment.

Both assessments are closely linked to the Directors' assessment of the principal risks facing the Group (including those that would threaten its business model, future performance, solvency or liquidity), which is outlined in the How We Manage Our Risks section.

Going Concern Statement

Accounting standards require that the Directors satisfy themselves that it is reasonable for them to conclude whether it is appropriate to prepare financial statements on a going concern basis. There has been no material uncertainty identified which would cast significant doubt upon the Group's ability to continue using the going concern basis of accounting for the 12 months following the approval of this Annual Report.

In assessing going concern, the Directors take into account the Group's cash flows, solvency and liquidity positions and borrowing facilities. At period end, the Group had cash and cash equivalents of £410.8 million (2017: £150.0 million), external gross debtA of £286.1 (excluding finance leases payable to MHE JVCo of £74.5 million (2017: £283.9 million)) and net current assets of £247.0 million (2017: £10.3 million). The Group has a mix of short and medium-term finance arrangements and has £250.0 million senior secured notes due 2024 and a £100.0 million revolving credit facility which contains typical financial covenants and runs until June 2022. The Group forecasts its liquidity requirements, working capital position and the maintenance of sufficient headroom against the financial covenants in its borrowing facilities (see below). The forecasts involve the Directors making judgements about future revenue, EBITDAA and capital expenditure and the cost of future financing. The financial position of the Group, including information on cash flow, can be found in Our Financials. In determining whether there are material uncertainties, the Directors consider the Group's business activities, together with factors that are likely to affect its future development and position (see our Strategic report), the Group's principal risks and the likely effectiveness of any mitigating actions and controls available to the Directors (see our Risk Management Process).

Viability Statement

In addition to the going concern assessment, the Directors have considered the viability of the business.

The Directors have decided that three years was the most appropriate period for assessing the Group’s viability. Although the Group’s strategic plan forecasts beyond three years, the Directors also took into account the impact on forecast outcomes of the rapid growth of the business, its changing strategic opportunities and its investment and planning periods. The Group’s expansion into overseas markets during 2018 has not changed the chosen viability period as the underlying nature of the overseas business is similar to the existing UK business in terms of the planning and investment timeframes (including for new customer fulfilment centres)

The Directors rely on several existing processes to justify their viability assessment. The annual budget, is used to set targets for the Group and is used by the Remuneration Committee to set targets for the annual incentive plan. A longer term business model provides less certainty of outcome, but is a sensible planning tool against which strategic decisions can be made. The plan makes assumptions about the business including projected capital expenditure, financing requirements, Ocado Solutions contractual commitments, available finance and compliance with any financial covenants.

To assist the Directors’ assessment, the financial projections in the longer term business model were subject to severe but plausible stress tests whereby certain key assumptions were adjusted downwards, notably:

  1. A material decline in the rate of revenue growth;
  2. A material decline in gross margins or increase in operating cost;
  3. A material increase in engineering costs for future CFCs (both on its own and in combination with the previous stress test);

A decline in sales growth or margins can result from a range of principal risks in the retail business including failure to maintain a competitive pricing position, a decline in customer service levels and a delay in implementing new capacity (see Principal Risks). A change to future engineering costs is a potential consequence of other principal risks such as not having sufficient technology and engineering resources to continue improving our OSP solution or not delivering the expected reductions to its long term cost of ownership. The Directors consider it reasonable to believe that the Group’s £100 million revolving credit facility, which runs until mid 2022, and senior secured notes due 2024, will be refinanced or extended, or that other financing will be available, to provide continuing finance to the Group. The Directors’ assessment also took into account other principal risks that could impact on the future performance of the Group and those that would threaten its business model, solvency or liquidity and also the likely effectiveness of any proposed mitigating actions (see Principal Risks). The Directors considered the potential impact of Brexit on the Company’s viability; in their judgment the risk of its EEA employees losing their UK employment rights was small even in the event of a “no-deal Brexit”, and that other potential impacts such as imposition of trade tariffs or disruption to supply chains would be covered by the circumstances envisaged under scenarios one and two above.

The stress tests were evaluated for various outcomes including the impact on the Group’s net cash/(debt)A and cash flow over the three years and an assessment of the impact of the financial covenants in the revolving credit facility, all of which are relevant to assessing the solvency and liquidity of the Group.

The above considerations form the basis of the Board’s reasonable expectations that the Group will be able to continue in operation and meet its liabilities as they fall due over the three year period from approval of this Annual Report.

For information concerning the review of going concern and viability see the Audit Committee report. The external auditors have reviewed these statements and having nothing to report (see the Independent Auditors’ report).