
How risks are identified,
monitored and controlled
Supported by the Audit Committee, the Board
has overall responsibility for risk management
and for reviewing its effectiveness. The Board
delegates the responsibility of implementing
and maintaining controls to the Executive
Committee and senior management to ensure
that risks are managed appropriately and
atthe right level. The Company’s risk
management and control framework includes
internal and external audit procedures with
ourinternal audit function bolstered by expert
co‑source in areas of high inherent and
residual risk, such as cyber. Other company‑
wide forums include, the Investment
Committee, which assesses the risk and
sensitivity analysis for deployment of the
Company’s capital expenditure programme,
and the Risk Committee, which evaluates
principal and emerging risks, and our control
framework. A summary of our principal risks,
together with details of how these are being
managed or mitigated, appears on pages 23
to 25. The Risk Committee are also leading
theworkstream to ensure readiness with the
implementation of Provision 29 of the 2024 UK
Corporate Governance Code (the ‘Code’)
which is described in further detail below.
During the reporting year, the Board has
supported the development of a Board
Assurance Framework (BAF) to support risk
management and to help ensure effective
governance by providing continuous assurance
on delivery of strategic objectives. The BAF
identifies strategic and material risks which
relate directly to achievement of the business
strategy. As part of this process, all such risks
and their associated controls were assessed in
detail by the Executive Committee and
reported to the Board, thereby enhancing our
ability to achieve our strategic objectives as
well as effectively manage risk.
The BAF supports, and is an integral part of
ourrisk management processes which include
the collection, assessment and tracking of the
material risks identified, in addition to the
otherkey operational and financial risks
andcontrols, all of which are assigned a risk
owner. This is supported by risk management
software which each owner has access to
through the Company’s portal. The software
uses a 5x5 matrix and each risk owner has
permanent access to risk register and
heatmap‑style reporting which assesses, in an
integrated way, the net assessment of each risk
after controls and the likelihood and impact
ofrisk events. The ongoing review of our risk
management processes is the responsibility of
the risk management team and this year they
have, as part of the Provision 29 workstream,
identified a more dynamic software solution
which will improve integration and real‑time
risk assessments on a continuous basis. It will
also enhance accountability and visibility of
material control effectiveness for the Board.
Anew taxonomy of risk is being designed to
provide first line risk owners with an improved
understanding of how every risk, whether
operational, financial or commercial, supports
the delivery of strategic objectives.
The Risk Committee supports the risk
management team by providing direction to the
management of risk across the business. It meets
quarterly and this year its activities have
included: leading the workstream to ensure
readiness for Provision 29, assessing and
undertaking reviews of risk workshops
designed to test control effectiveness and any
gaps, critical assessment of all materials and
principal risks and assisting with the assessment
of emerging risks and opportunities.
Emerging risk and opportunities
The formal identification and assessment of
emerging risk is embedded within our overall
risk management framework and overseen by
the Risk Committee; however, as we operate
ina dynamic and fast‑paced environment,
emerging risk and potential opportunities are
regularly discussed and debated by the Board
and the Executive Committee in the ordinary
course, particularly those arising from the
continuing uncertain macroeconomic and
geopolitical landscape, and the potential
impact on our business and the consumer.
Additionally, through the Risk Committee, all
risk owners and managers are encouraged to
consider emerging risks so that emerging risks
and potential opportunities are considered
through a number of important, but different,
lenses. The Company also maintains an
emerging legislation tracker which is periodically
reported to the Audit Committee with oversight
of implementation plans and any remedial
plans to cover any gaps.
This year, through the various forums, we
considered emerging risks arising from new
oramended regulation likely to impact the
Company and the wider hospitality sector.
Through reports to the Audit Committee and
presentations to the Risk Committee, we
considered the Company’s readiness and
exposure to, the Employment Rights Bill and
through discussions at the Risk Committee and
the Executive Committee, we considered the
potential reform in gaming and leisure
machines. AI is rapidly reshaping the
hospitality sector, offering significant potential
to enhance operational efficiency and
experience. However, as deployment of AI
may introduce emerging or enhanced risks,
thegovernance and oversight were considered
(and continue to be considered) by the
Company and, supported by the Risk
Committee, is committed to ensuring
responsible adoption. For Marston’s, AI
represents a dual challenge: mitigating risks
through robust controls while leveraging its
transformative capabilities to drive innovation,
help control costs and deliver sustainable growth.
Risk appetite
The Board sets the Company’s risk appetite,
defining the level and types of risk it is willing
to accept in pursuit of the strategic objectives
and in alignment with our values. During the
reporting year, the risk appetite for our
material risks was reviewed by the Board
andthe Executive Committee as part of
thedevelopment of the BAF. The Board is
committed to ensuring that the business
operates within its risk appetite and takes into
consideration the principal and material risks
of the business when it assesses the long‑term
viability of the Group. While certain external
risks, such as macroeconomic or regulatory
changes, may require a higher level of
acceptance due to their uncontrollable nature,
the Company seeks to anticipate and mitigate
these wherever possible.
Risk appetite guides decision‑making within our
organisation and ensures that risks are managed
within clearly defined boundaries. Inaddition,
one of the responsibilities of the Investment
Committee is to ensure that our returns on capital
employed are in line with theapproved business
case for capital projects and the expectations
of our Board as well as being balanced with
the inherent risks involved in such projects.
Risk and risk management continued
Strategic report Governance Financial statements Additional information Marston’s PLC Annual Report and Accounts 2025 21