AmazonScience/document-haystack

1Principal Risks202. Data Privacy and 3Cyber Resilience4Chief Product and Technology Officer; 5General Counsel6Link to Strategic Objective:7 Organic Growth8 Margin Expansion9 US Market Growth10Impact:  Very High11Risk Oversight:  Audit Committee12Why this matters to us 13Our customers expect a great experience, 14including protecting their personal details, 15their privacy, their winnings and ensuring 16the integrity of our offering. Customers 17place a trust on our organisation and 18our operations, so it is of paramount 19importance that we protect our customers’ 20data by keeping it secure, in addition, 21personal data is subject to stringent data 22protection laws around the world, and 23we have compliance obligations in the 24jurisdictions in which we operate.25A data or security breach could impede 26our operations and impact our ability to 27serve customers and would undermine 28trust in our business and brands, 29and could lead to loss of customers, 30prosecution, litigation (including class 31actions), significant financial penalties and 32impact our share price.33How we respond34The Group has dedicated Cyber Security 35and Data Privacy functions entrusted with 36protecting the security and confidentiality 37of our customers and the company, whilst 38ensuring the availability of services and 39regulatory compliance. 40The experts in our Cyber Security team 41constantly scan and adapt our defences to 42emerging cyber threats.43We operate to an ISO 27001 Information 44Security Management System 45certification, the Cyber Security controls 46and associated policies are constantly 47being evaluated, aligned, and applied, 48where deemed relevant across the 49enlarged Group. 50The Data Privacy team, led by the Group’s 51Chief Data Privacy Officer matures our 52privacy programme through designing 53policies and training, including on the 54use of AI, giving up to date advice to 55the business, ensuring standards of 56compliance, partnering with the Chief 57Data Officer and other key stakeholders 58to improve our data management 59practices and providing regular updates 60to the Group’s Audit and Sustainability & 61Compliance Committees.6201. Laws, Regulations, 63Licensing and Regulatory 64Compliance 65Group General Counsel66Link to Strategic Objective:67 Organic Growth68 Margin Expansion69 US Market Growth70Impact:  Very High71Risk Oversight:  Board72Why this matters to us73We operate in complex regulatory, 74legislative, and fiscal environments, 75and have multiple licensing obligations, 76gambling and non-gambling laws and 77regulations, and tax regimes with which 78to comply. In addition, on a global basis, 79laws and regulations change continuously, 80and it can be operationally challenging to 81keep pace with legislative or regulatory 82change, particularly if we need to adjust 83our operations or product offering at short 84notice. 85As we expand into new markets or laws/86regulations change, our compliance 87requirements expand, we need to build 88constructive relationships with regulators, 89and we are likely to need additional 90effort, resource and/or investment into 91our internal compliance and governance 92efforts.93In 2023, Entain entered into a deferred 94prosecution agreement (DPA) relating to 95historic bribery allegations in Turkey. All 96the above means that compliance efforts 97and having a strong, well-resourced 98compliance programme in place needs to 99remain a top priority.100How we respond101Our strategy is to operate only in 102regulated or regulating markets, which 103reduces our exposure to unregulated 104markets that may undermine player 105safety and pose other legal risks.106Our internal experts monitor for changes 107in legislation and regulation and develop 108policies, procedures, assurance programs, 109and training to enable us to adapt. They 110are engaged in due diligence when we 111engage new suppliers, onboard new 112customers, enter new markets or acquire 113new companies. All these efforts reflect 114the commitments to compliance in our 115Code of Conduct.116External legal expertise is sought when 117additional specialist support is necessary. 118We will ensure that we comply with all 119the terms of the DPA and continue to co-120operate with regulators as required.121We consider principal risks to be those 122risks, or combination of risks, that, were 123they to materialise and not be effectively 124controlled, would cause material disruption 125to our business model, threatening future 126performance, solvency, liquidity, or our 127ability to deliver our strategy. Risks at this 128level are recorded on our Significant Group 129Risk dashboard. Group risks are considered, 130along with material emerging risks to define 131our Principal Risks.132During our periodic risk reviews, we 133confirmed that all principal risks reported 134in 2022 remain relevant except for ‘Loss 135of Key Locations ’, which now forms part 136of ‘Ensure Health, Safety, Security and 137Well-being of Employees, Customers, and 138Communities’  and ‘Maintain Technology 139Platform Resilience’ . This is because 140a deep dive helped us understand that 141the most significant impacts of loss of 142key locations would be to our people or 143technology, and the controls for these risks 144will largely be managed in these areas.145One new principal risk has been identified, 146namely Price and Service of Delivery from 1473rd Party Suppliers and added to the 148Group risk register in 2023. 149The Groups Principal Risk for 2023 are:150Entain plc Annual Report 2023 831511 Overview 8  Strategic report 88  Governance 140  Financial statements152The secret shape is a "rectangle".