Risk management

Our risk management system continues to evolve; we have an established process to manage the risks we face as a business.

Our Strategic Model strategy and risk

Our strategy and business model create a number of risks and opportunities for the business. The Board is ultimately accountable for the effectiveness of our risk management and internal control systems, and is supported by the Audit Committee, Executive Committee and delegated committees, who oversee our risk management system to ensure that risks are appropriately identified and managed within IHG’s risk appetite.

Risk appetite

IHG’s risk appetite is visible through the nature and extent of risk taken by the Board in pursuit of strategic and other business objectives. This risk appetite is cascaded through the goals we set, decisions we make and how we allocate resources. IHG’s appetite and tolerance for risk is further implemented through our governance committees, structures, policies and targets we select, as well as in development guidelines for new hotels. In 2017, the Board and Board Committees have reviewed many of these aspects directly through their meetings and discussions of principal risks.

IHG’s principal risks, uncertainties and review process

The external risk environment remains dynamic. However, the Group’s asset-light business model, diverse brand portfolio and wide geographical spread contribute to IHG’s resilience to events that could affect specific segmental or geographical areas. Our Risk Working Group, chaired by the General Counsel and Company Secretary and comprising the Group Financial Controller and the heads of Global Risk Management, Global Strategy and Global Internal Audit, provides input on, and oversight of, the principal risk review process, which identifies and assesses risks for ongoing monitoring and review by senior management.

Throughout 2017 the Global Risk team have performed continuous assessments of the principal risks facing the Group, including those which would threaten its businessmodel, future performance, solvency or liquidity. These risks are formally reviewed with the Group’s Directors on a bi-annual basis and considered in more detail through the activities of the Board and Committees. As part of our reviews we have consolidated
a previously identified risk relating to our owner proposition into other factors listed.

We are now focused on executing our strategy at a faster pace. This emphasises the importance of the steps we take to consider risk explicitly as part of decision making, for example in the reprioritisation of resources, as well as considering the effect of any operational or functional changes on our risk management system described above.

Our principal risks remain structurally similar to those reported in previous years. However, we have noted the potential impact of the initiatives we are putting in place to accelerate growth both as a specific risk and also with the inherent trends and measures we undertake to mitigate other risks to a residual level appropriate to our risk tolerance, given a more dynamic organisational context. In addition, we continue to conclude that the potential impact of Brexit on IHG will have no material impact on our strategy or operations.

Our risk management system

Our risk management system is fully integrated with the way we run the business through our culture, our processes and controls and our reporting, and is reflected in our strategy. The Global Risk Management function is responsible for the support, enhancement and monitoring of the effectiveness of this system and focuses on culture, process and control and monitoring and reporting.

Risk and culture

  • Our tone, attitudes, ethical values and policies
  • Our governance and committee structures

Risk and control management

  • Three lines of defence - which is compared of (i) day-to-day activities that identify and manage risks, (ii) our functional specialists, such as our Business Reputation and Responsibility teams, and (iii) independent assurance
  • Strategic risk planning

Risk monitoring and reporting

  • Risk and performance monitoring
  • Principal risk reporting

More information on our risk management system is available at www.ihgplc.com under Responsible business, Our culture of responsible businesses, and Risk management.

Risk trend and speed of impact

Through the principal risk process we assess whether the risk area is stable or dynamic (inherent risk trend), and the rate at which there could be a material impact on IHG (speed of potential impact). The trend and unmitigated speed of impact are summarised in the following diagram with further detail on the initiatives undertaken to manage each of these risks in the table on the next page.

 

Principal risks

Inherent risk trend:

  • Increased risk Dynamic

  • No change in risk Static

Risk impact - How each principal risk links to our strategic priorities:

  • Winning model Strategic Model

  • Targeted portfolio Targeted Portfolio

  • Disciplined execution Disciplined Execution

  • Responsible business Responsible Business

Inherent threats to cybersecurity and information governance continue to evolve at pace and, in 2017, created dynamic risks to multiple industries, evidenced by reported cyber incidents across the hospitality industry and by IHG. This risk could impact our operations; lead to loss of sensitive data; undermine stakeholder trust; and result in fines and legal/regulatory action.

Trend

No change in risk

Impact

Winning model

Targeted portfolio

Targeted portfolio

Initiatives to manage these risks

  • We apply a risk-based methodology to identify, and consider the value and threats to, our key information assets. These include Payment Card Information (PCI), Personally Identifiable Information (PII), as well as sensitive financial and employee information. We monitor and update our information security policies and practices to respond to the risks we face, including those relating to evolving privacy requirements across IHG, including our increasingly third party hosted infrastructure and systems.
  • Our approach to monitoring this dynamic risk combines IHG specialist teams in information security, technology and cyber enabled crime, supplemented by external insight and relationships to enhance our capability to analyse, prevent and detect potential threats.
  • During 2017, we continued our initiative to tokenise credit card data in key systems through implementation of our secure payment technology in more than 86% of our US franchised estate.
  • Despite our information security programme, we also recognise the need for rapid and appropriate response to data incidents. We have a clearly developed incident management capability which clarifies accountabilities and processes across the organisation, and works closely with our insurers. These also consider data reporting obligations, for example in relation to the EU General Data Protection Regulation (GDPR). 

Failure to deliver preferred brands and loyalty could impact our competitive positioning, our growth ambitions and our reputation with guests and owners. The rapid rate of recent consolidation activity; brand launches and loyalty programme developments across the hospitality industry creates both risk and opportunity.

Trend

No change in risk

Impact

Winning model

Targeted portfolio

Initiatives to manage these risks

  • In 2017 we continued our investment of $200m in the refresh of the Crowne Plaza estate in the Americas; extended the implementation of our Holiday Inn Open Lobby; and updated room design concepts in several brands. We launched avid hotels to positive reactions from owners, signed deals to extend other brands in new territories and built brand recognition across the portfolio. In January 2018 we also integrated our Kimpton Karma members into the IHG Rewards Club programme.
  • The creation of one Global Marketing function will enable us to focus on fully integrated brand, marketing and loyalty activities, strengthening our existing brands and adding new brands where we see greatest potential for growth.

Leadership and talent risk is inherent to all businesses and failure to effectively attract, develop and retain talent in key areas could impact our ability to achieve growth ambitions and execute effectively.

Trend

No change in risk

Impact

Winning model

Disciplined execution

Responsible business

Initiatives to manage these risks

  • In 2017, we have enhanced our ability to attract, retain and develop the best talent within the hospitality sector, including GM and senior corporate positions.
  • Our focus on accelerating growth will increase opportunities for our people and our ambitions will place demands on key leadership and hotel talent. As we begin to redeploy and reprioritise resources, our human resources team are reviewing our performance management framework to promote interdependence and to incentivise team and individual performance. We have a global diversity and inclusion strategy which will be led by a Diversity and Inclusion Board, with specific and targeted actions to address any inequalities in the workplace.
     

Failure to capitalise on innovation in booking technology and maintain and enhance our channel management and technology platforms and to respond to changing guest and owner needs remains a dynamic risk to IHG’s revenues and growth ambitions, particularly with the emergence of both evolutionary and disruptive technologies.

Trend

Increased risk

Impact

Winning model

Disciplined execution

Initiatives to manage these risks

  • Technology innovation in the hotel industry continues to accelerate, with established and new competitors launching new solutions leveraging technology to enhance guest and owner experience. The speed of technological development and implementation in key markets such as China requires constant focus.
  • Our Commercial and Technology team continues to develop on and above property capabilities and functionality including responsive website design; mobile check out, while undertaking controlled pilots in more complex areas such as mobile key solutions. In mid-2017 we began to pilot out IHG Concerto which, as well as increased functionality, will increase the resilience of our revenue systems. We have also implemented our centrally controlled and high-performing IHG Connect solution to benefit owners and guests.
  • Changes to accelerate our growth will enable us to prioritise resources and streamline technology governance practices to drive efficiency and pace in our innovation and project delivery.

IHG’s focus to accelerate growth will require significant reprioritisation of activities and refocusing of resources. Given the importance and scope of the multi-faceted initiatives that will be undertaken to accelerate growth there are inherent risks which will require appropriate planning, project management, governance and clearly defined success factors.

Trend

No change in risk

Impact

Winning model

Targeted portfolio

Disciplined execution

Responsible business

Initiatives to manage these risks

  • Our executive team, supported by our programme office, is providing direct leadership and steering a portfolio of activities to accelerate growth, engaging our wider senior leader team to clarify and align on objectives, key drivers and associated behaviours required in the future; and to provide regular visibility to the Board to ensure that the scope and timing of delivery remains within our risk appetite framework.
  • We are also supported by third party expertise to enable us to reprioritise resources and sequence activities in the most impactful way across the organisation, whilst mitigating and assuring risk to an acceptable level.
  • Our focus on accelerating growth involves evolving our risk management system, governance and assurance arrangements to enable effective and agile decision making during the organisational change, in alignment with our appetite and tolerance for risk.

Failure to maintain an effective safety and security system and to respond appropriately in the event of an issue could result in an adverse impact to IHG; such as reputational and/or financial damage and undermining stakeholder confidence.

Trend

Increased risk

Impact

Winning model

Disciplined execution

Responsible business

Initiatives to manage these risks

  • The environment in which IHG develops and operates hotels continues to evolve, creating continued inherent challenges to the safety and security expectations of our guests and owners. Although we assess this risk to be stable overall, our Risk team coordinates and monitors a management system designed to provide an appropriate level of control of safety and security in IHG branded hotels and IHG offices.
  • Our design & engineering, hotel opening and operations teams work together with our operational safety and security experts to evaluate our standards and provide guidance and training to our owners and hotel colleagues. We also have internal and external threat intelligence expertise to monitor potential impacts on IHG from, for example, terrorism.

Whilst the hotel sector is not subject to stringent industry specific regulations, the global business regulatory environment is continuously evolving and failure to ensure legal, regulatory and ethical compliance would impact IHG financially, operationally and reputationally.

Trend

No change in risk

Impact

Winning model

Disciplined execution

Initiatives to manage these risks

  • Our regulatory compliance specialists work to identify and respond to relevant regulatory and societal expectations. This is a particular imperative in relation to new privacy and cyber legislation, such as the EU GDPR and China’s new Cyber Security law, and continued scrutiny of the hospitality industry in relation to the environment and human rights.
  • Our regulatory compliance programme focuses on bribery, sanctions, data privacy and competition compliance, with expectations defined within our Code of Conduct and related policies and training and awareness tools. Our development and legal teams work closely during owner due diligence procedures and escalate any identified ‘red flags’ for senior leadership review and decision. We also have in place a whistleblower hotline to report any concerns and defined controls which are routinely monitored. For example, we regularly review our gift and entertainment processes and registers to ensure these remain appropriate and are complied with.

A material breakdown in our financial management and control systems would lead to increased public scrutiny, regulatory investigation and litigation.

Trend

Increased risk

Impact

Disciplined execution

Responsible business

Responsible business

Initiatives to manage these risks

  • This risk has not experienced any material change in 2017, however IHG continues to operate a strong set of processes across its financial, operational and compliance processes. Our finance team has worked to understand and prepare for changes to revenue recognition reporting under IFRS15.
  • We continue to develop a scalable finance operating model, with increasing use of analytical capabilities, to enable us to adapt to future changes in the industry landscape and as we redeploy and refocus resources.

The inability to realise value from our programme and project delivery may result in failure to improve commercial performance, financial loss and undermining of stakeholder confidence.

Trend

No change in risk

Impact

Targeted portfolio

Disciplined execution

Initiatives to manage these risks

  • IHG is currently delivering multiple high value and complex business change programmes. Resource prioritisation across these initiatives is overseen by our executive team, and processes, education and support have been provided throughout 2017 to increase the quality and consistency of programme delivery. Our plans to accelerate our growth will build on these capabilities during 2018 to review end-to-end processes and manage delivery interdependencies across IHG.