Overview

Exposure to risk is an inherent element to carrying out the business activities of the Group; the operation of vessels and provision of related services. Effective risk management and internal control systems are essential to protect the Group from exposure to unnecessary risks and to ensure the sustainability of the Group’s business.

The Board has overall responsibility for establishing procedures to manage risk, oversight of the internal control framework and determining the nature and extent of the principal risks the Group is willing to accept in order to achieve its long-term objectives. The Board has created a culture of risk awareness throughout the organisation whereby risk consideration is embedded in decision making processes.

The Board has delegated the appraisal of the Group’s risk management and internal control systems to the Audit Committee. This assessment is carried out through the review of reports and presentations made by the Risk Management Committee (RMC) and Group Internal Audit. Further information on the Audit Committee activities is set out in its report on pages 94 to 99.

Risk Architecture, Strategy and Protocols

The Group follows international standard ISO 31000 (2018) ‘Risk Management – Guidelines’ in designing its risk architecture, strategy and protocols (RASP).

The Group’s risk architecture includes the roles and responsibilities of the Board and Group personnel in managing risk, along with internal reporting requirements. This is illustrated by the ’three lines of defence’ model.

Roles, responsibilities, risk management policy, objectives and process overviews are documented within the Group’s Risk Code. The Group adopts an Enterprise Risk Management (ERM) system that takes a unifying, broad and integrated approach to managing risks and aligns risk management to the achievement of strategic objectives.

Role of the Risk Management Committee

The Risk Management Committee (RMC) established by the Group comprises members from across the three lines of defence, as well as having Board representation. With its mandate from the Board, the RMC is tasked with;

• Making appropriate recommendations to the Board on all significant matters relating to the development of risk strategy and processes of the Group.
• Keeping under review the effectiveness of the Group’s risk management systems.
• Reviewing the Group’s risk exposures in relation to the Board’s risk appetite.
• Maintaining a robust Group Risk Register and ensuring risks are identified comprehensively and assessed consistently across classified risk areas.

Risk Management Process

The Group’s Risk Management Process is underpinned by its RASP methodology and is led by the RMC. The Group’s process is based on the revised international standard ISO 31000 (2018), ‘Risk Management – Guidelines’, and provides an iterative and systematic approach to managing risks throughout the Group.

Risk Assessments and Monitoring

The Board sets the Group’s risk appetite for classified risk areas. Risk appetite is communicated through the adoption of Risk Appetite Statements. These statements, along with internal capabilities, resources and industry factors provide context to how the Group’s strategy is pursued and to which risks are assessed. With respect to climate and ESG issues, the views of stakeholders are also considered by the Board in setting appropriate appetite levels. Refer to pages 64 to 66 for an overview of the Group’s climate risk framework. The Board has a low acceptance for risks that may impact safety of vessels, workers and customers and compliance with relevant laws and regulations.

Each business owner is responsible for ensuring comprehensive risk identification and assessment is carried out covering their sphere of responsibility. Risks are identified through various means, including the use of an identification tool guiding risk assessors through several internal and external factors in identifying potential barriers to respective objectives. Risks are assigned to risk owners with responsibility for the activity generating the risk. Where a risk contains multiple causes and consequences, risk owners are required to collaborate in performing a cause and consequence analysis.

For some risks, this collaboration spans across departments and divisions within the Group.

Risk owners are ultimately responsible for the completion and maintenance of risk assessments across their respective risk areas. Risks are measured in terms of the likelihood of occurrence and estimated impact using a standardised scoring model. All evaluations are made from a Group perspective and are relative to Group risk appetite. Guidance tools are in place to ensure Group-wide consistency is achieved across risk assessments.

Existing control measures are documented and assessed within the risk assessment forms in determining residual risk scores. All risk assessments are reviewed by members of the RMC before they are released to the Group Risk Register. The RMC and risk owners can prescribe the implementation of further control measures at the review stage.

The Group Risk Register is the central online repository for documenting, assessing and prioritising risks, and for documenting and prescribing control measures. The Register forms a significant portion of the Group’s risk management process. The Group Risk Register is reviewed on a regular basis by the RMC.

Any necessary changes to the Group Risk Register are made throughout the year and can be prompted by;

• The occurrence of a risk event.
• The identification of new emerging risks or as circumstances of existing emerging risks change.
• Quarterly RMC meetings.
• Internal Audit or regulatory reviews.
• Annual risk owner reassessment.
• Changes in Key Risk Indicator measurements.
• New risk assessments completed within business area teams.

Risk information within the Group Risk Register is analysed and used for reporting principal risks to the Board and for Internal Audit planning. A presentation of the Group’s principal and emerging risks is made to the Board at least annually or more frequently if warranted by developments. At these presentations the Board challenges the RMC in their processes and evaluations of the principal and emerging risks identified in the context of the Group’s own risk policy, risk appetite and general market developments both within and outside the industry sector. Key Risk Indicators are in place for highly ranked individual risks at the residual level, to ensure exposure levels are monitored, flagged to the Board and corrective actions taken before impacts are fully realised.

Emerging Risks

Risk monitoring is an ongoing process to reflect the dynamic nature of the environment in which the Group operates. The Group acknowledges three types of emerging risks that can arise. The first type are new risks that emerge in the Group’s external environment. These are identified through the ongoing Group risk identification process. The second type are previously identified risks recorded in the Group Risk Register whose impact on Group activities has changed, prompting a reassessment. The third type are new risks emerging from the internal environment when changes to core processes are made. These are identified when undertaking new projects or engaging with new business partners.

Emerging risks are closely monitored and assessed as their uncertain nature can result in the risks becoming significant within a short timeframe. Emerging risks currently under review at the date of this report relate to greater employer responsibility for employee welfare, greater environmental and climate awareness driving increased corporate responsibility and regulatory requirements and long-term risks and opportunities associated with technological advancements.

Managing Climate Change Risks

The Group has adopted a framework, based on guidance from the Institute of Risk Management, which identifies the key areas that require attention to enable the development and execution of its climate change risk management strategy. This framework is integrated within the Group’s RASP and related risks assessments are released to the Group Risk Register.

1. Climate Change Risk Landscape

The Group identifies climate risks using the same processes as other emerging risks, with additional emphasis on expert climate risk publications and regulatory updates. Climate change risks are unique in how they; affect every individual and organisation, are long term in nature and are highly uncertain in their ultimate progressions and impacts. Due to these considerations, the Group’s climate risk register contains the following additional details;

• Risks are assessed over three different time horizons; 0-3 years, 3-10 years and >10 years, with the 0-3-year horizon assessments transferring to the Group Risk Register.
• Impacted stakeholder groups are identified for engagement on associated risks.
• Opportunities are identified for each risk to support strategic positioning and resilience planning.
• Impacts are linked to financial statement areas.

A summary of the Group’s climate risks, impacts and opportunities is disclosed on pages 56 to 57.

2. Effective Governance Systems

The Group applies the same risk governance structure to climate change risks as all enterprise risks. The RMC advises the Board on risk appetite, risk management approach and important risk management issues and considerations, which are ultimately approved by the Board or used to facilitate decision making.

The RMC presents to the Board during the year on all important risk management issues, including climate change and ESG risks. Executive Management are also equipped to update the Board on such matters throughout the year, as 75 percent of the Executive Management Team are RMC members. The Group’s recent Board appointments helps ensure there is adequate Non-Executive Director representation with ESG expertise to challenge the RMC and Executive Management on relevant issues.

The RMC is comprised of management across all areas of the business, including; risk and sustainability, sales, operations, health and safety, planning and finance. Collectively, the RMC has the skills, knowledge and experience to best manage the Group’s climate change risks and their wide-ranging impacts. ESG issues are incorporated in the incentive plans of Executive Management and dedicated management roles within the RMC.

3. Stakeholder Insights and Research

The interests and expectations of stakeholders are important considerations in the Group’s climate risk management approach. In 2022, the Group will undertake a stakeholder research program to gain insights on ESG issues facing the Group. This will facilitate an evaluation of our core strategic, operational and compliance processes concerning the environment and climate change expectations. Mapping of these insights will help align stakeholder values to the Group’s strategic objectives and core processes.

4. Risk Appetite Setting

Following the outcome of the stakeholder engagement program, the RMC will develop more specific risk appetite areas across a range of ESG issues. Areas of highest stakeholder importance will be considered in setting the appetite levels for Board approval. All ESG and climate change risks going forward will then be assessed, and mitigation plans updated to ensure they remain proportionate to the relevant appetite levels.

5. Materiality Assessment over Alternative Horizons

Climate change risks are assessed over three separate horizons; 0-3 years, 3-10 years and >10 years. Current known transition risks are most significant in the short and medium term and are expected to curtail from the third time horizon as the Group shifts towards a low carbon economy. While physical risks require attention today, significant physical impacts for the Group may only be experienced over the long-term horizon.

Assessments over the long-term horizon are most challenging to calculate but are key to future resilience planning. The Group is exploring further methods to help quantitively analyse the impact of certain future scenarios.

6. Strategic Positioning and Roadmap

Following a full assessment of risks and opportunities over separate time horizons, the Group can assess strategically its current position against long-term goals. This stage allows the Group to identify any changes to its business model necessary for long-term success, with a focus on opportunity management. Further climate change related controls and projects are then agreed.

7. Implementing Mitigation and Resilience Plans

Further controls and projects to help address climate change risks are implemented and managed. Current resilience plans, including the Group’s Major Incident Response Plans and Disaster Recovery Plans are also reviewed and updated periodically for additional information gathered throughout the process.

8. Operationalise Metrics and Targets

Metrics and targets, including carbon intensity and absolute GHG emissions are monitored and reviewed. Relevant Key Risk Indicators are also introduced to monitor high residual risks, in line with the Group’s risk management process.

Significant and Emerging Risk Events

Covid-19 Pandemic

The Group responded promptly when the Covid-19 pandemic began to affect operations in 2020 and this continued throughout 2021. Actions taken had two principal emphases:

1. Measures to ensure continuing safe operations and the communication of such measures to all stakeholders including state authorities and customers; and,
2. Measures to ensure the financial viability of services throughout cost-cutting, efficiencies and service restrictions.

A specific and detailed pandemic risk assessment was carried out in 2020 with input from across all divisions and departments which was updated throughout 2021 as necessary.

While some services continued to be curtailed in 2021 and passenger travel was impacted by varying regulations during the year, all operations have been maintained safely including during times of increased passenger demand for ferry services. Global supply chain congestion meanwhile brought opportunities for the Container and Terminal Division. The Group is strongly positioned for success in 2022 as regional restrictions are removed and tourism can safely return to pre-pandemic levels.

Brexit

A specific and detailed risk assessment was developed prior to the end of the transition period on 31 December 2020. This risk assessment was updated throughout 2021 and the risks which materialised were in relation to:

1. Negative impact on the Republic of Ireland (ROI) – Great Britain (GB) freight market due to additional customs and health formalities; and,
2. Market distortion due to re-routing of freight traffic via Northern Ireland and via the direct route to France, to avoid customs and health formalities. However, this risk has also brought the opportunity of increased demand for our ROI – France route.

The Group will continue to monitor the impacts of Brexit, particularly as additional requirements for GB customs controls are implemented in 2022.

Environmental Regulations and Impacts

The Group is exposed to long-term physical effects of climate change and to near and long-term transition risks associated with the movement towards a low carbon economy, driven by changing stakeholder expectations and environmental regulations. During the year, significant regulatory measures and proposals were announced by the IMO and the EU to help achieve the respective GHG reduction targets of each organisation for the maritime transport industry.

Current IMO Measures

• An annual operational Carbon Intensity Indicator (CII) assessment and rating from 2023 to determine how efficiently a ship transports goods or passengers.
• The introduction of the Energy Efficiency Design Index for existing ships (EEXI) which sets from 2023 a baseline technical design efficiency that vessels must meet.

Current EU Proposals

• The extension of the ETS to the maritime industry on a phased-in basis from 2023 to full implementation by 2026, requiring ICG to purchase and submit emissions allowances for each equivalent tonne of CO2 emitted from vessel operations.
• The introduction of the FuelEU Maritime regulation to limit the GHG intensity of energy used on board vessels from 2025.
• The removal of the heavy fuel oil exemption for the industry under the Energy Taxation Directive.

The Group will continue to monitor these developments and liaise with regional chambers of shipping, shipowners’ associations and other industry representatives as further information is announced. These regulations could have significant financial and operational impacts for the Group and are currently being managed within the climate risk framework. In mitigation of potential financial impacts, the Group shall seek to recover increased costs through its value chain. The Group has been an early adopter of technology and assessments to certify EEXI compliance for the Isle of Inishmore and Ulysses in 2021, with further studies and measures across the remainder of the fleet scheduled in 2022. The W.B. Yeats is assessed as a new vessel under the Energy Efficiency Design Index (EEDI) and is excluded from EEXI.

War in Eastern Europe

The Group is deeply concerned by developments in Eastern Europe following the invasion of Ukraine by Russia. A full organisational-wide risk assessment was conducted as geopolitical tensions escalated in early February 2022. Among the potential impacts under ongoing assessment at the Annual Report release date include:

• The impact of economic sanctions on Russia on Group operations and fuel prices
• Impact on passenger demand due to ticket price inflation
• Increased cyber security risk to assets and operations
• Business continuity risks associated with supply of fuel and key third party contractors

Viability assessment

The principal risks identified through the Group’s risk processes have been considered by the Directors when preparing the Viability Statement on pages 116 to 117, as part of their assessment of the prospects for the Group.

Principal Risks and Uncertainties

Linkage to strategic pillars:

Quality service

People and Culture

Financial management

Safety

Sustainability