THE UNITE GROUP PLC Annual Report and Accounts 2024 61 PRINCIPAL RISK Technology risk 10 Objective: Maintain and enhance a secure IT environment that discourages attacks, and informs us when issues have been detected and provides us with greater operational capacity Risk: Significant loss of personal or confidential data, disruption to corporate systems either through cyber-attack or internal theft/error Events that may trigger the risk • Threat actors attempting to compromise systems through social engineering, prolonged remote attacks or physical access. • Changes to operational design, bringing requirements for improvements to digital infrastructure. Potential impact • Significant loss of personal or confidential data or disruption to the corporate systems. • Reputational and/or financial damage with increased scrutiny including sanctions and fines. • Reduced benefits from operational efficiencies. How we monitor and mitigate • Defined governance structure for information security. • Technical security controls aligned to SANS CIS Critical Security Controls. • Security operations centre and security incident & event management. • Full suite of awareness activities. • Agreed Information Security strategy & technical security roadmap. • Information security and data protection policies in place. • Scheduled internal phishing campaigns. Events that may trigger the risk • Deficiencies in control design. • Inadequate segregation of duties. • Employee disengagement or external motivation to act contrary to our values. Potential impact • Loss of assets or funds. • Significant loss of personal or confidential data or disruption to the corporate systems. How we monitor and mitigate • Independent verification of year-end account by our external auditors. • Internal audit programme to review internal control of high risk areas to the business. • Documented segregation of duties within IT and financial system. • Improved financial system in testing phase. 12 Objective: Maintain adequate controls to minimise the likelihood of fraudulent activity Risk: Internal controls are exploited to allow individuals to gain from asset misappropriation, fraudulent statements and corruption Reason for the change in risk profile: Movement away from legacy systems has removed a number of manual processes and introduced automation which decreases the likelihood of fraudulent activity. Events that may trigger the risk • Geopolitical factors influencing market sentiment. • External factors reduce access to capital markets. • Significant reduction in revenue, or other adverse business event, affecting market perception. • Significant reduction in property valuations or increase in debt. Potential impact • Increased financing costs leading to reduced profitability and property values (through resulting expansion of valuation yields and lower valuations). • Forced sales below valuation. • Slowdown in development. • Breach of covenant leading to default followed by repayment demand. How we monitor and mitigate • Movements in interest rates and the impact of different outcomes are considered at the Funding Committee. • Funding strategy is approved by the Board annually. • Minimum hedge ratio of 75% is defined in the capital operating guidelines (COGs); most debt is fixed rate or hedged with swaps or caps. • Revolving credit facility to provide liquidity headroom. • Maintaining a good relationships with lenders. • Management of balance sheet ratios in compliance with COGs. • Monitoring of covenants across a range of income scenarios and risks. • Regular monitoring of ICR covenants by the Funding Committee (six-monthly monitoring). PRINCIPAL RISK Financial risk 11 Objective: Manage our balance sheet liquidity within tolerable levels and maintain compliance with our debt covenants Risks: Borrowing costs rise rapidly or inability to obtain funding at cost within risk appetite Reason for the change in risk profile: Inflation has peaked, falling back through 2024. Although indications are that funding costs will remain high, due to interest rates not falling back as quickly as expected, we have limited exposure with suitable hedging in place.