Group risks

2. Non-compliance:
The risk that NS does not comply with legislation and regulations or exceeds applicable norms and values

The control of compliance was further strengthened in 2020, as part of a multi-year integrity and compliance programme. The management of compliance risks has been deepened and broadened in consultation with the business. In addition, compliance policy, monitoring and accountability were further expanded.

• The NS code of conduct was renewed and the policy management framework was further expanded. In addition, further efforts have been made to increase compliance knowledge and awareness, including through NS-wide training in the areas of integrity, competition and privacy. The NS Risk Framework has been further developed so that compliance is effectively factored in.
• With regard to specific compliance risks (such as fraud, soil contamination or Working Hours Act violations), measures have been taken and monitoring established. Risks are now also explicitly factored in and included in the NS Risk framework.

3. Revenue:
The risk that the revenue will remain low for a longer period of time or be structurally reduced.

Revenue fell sharply in 2020, and expectations for future years are also substantially lower due in part to more working from home. In addition, a new economic recession is not inconceivable.

• Various studies have taken place to understand changing travel behaviour, and traveller forecasts are updated with greater regularity. Based on this, investments and services are adjusted as necessary.
• Propositions are also adjusted to stay as close as possible to customer needs and what we need to adjust internally to do so.

4. Savings:
The risk that NS will not realise the necessary savings as a result of the COVID-19 pandemic.

The COVID-19 pandemic has disastrous consequences for our financial return. In order to balance spending with this, NS has established a €1.4 billion savings programme for the Dutch organisation, which will require a significant transformation.

• A dedicated team has been set up to drive the transformation and develop savings initiatives for direct and indirect employees. This seeks to realise cooperation with social partners and employees. Savings for 2020 have already been implemented and several requests for advice have been submitted. Investment plans are adjusted and put on hold if possible. Forecasts are periodically recalibrated and progress monitored.

5. Foreign operations:
The risk of NS making a loss on its investments abroad (Abellio).

Abellio UK has revenue risk on train contracts. Contracting authorities have assumed the revenue and cost risk as of March 2020. In order to be able to prematurely terminate the existing contracts and claim a new form of contract, a termination payment will be agreed upon.
Abellio Germany has no revenue risk, but is facing loss-making contracts due to insufficient compensation from contracting authorities for increased personnel and training costs and for the high fines related to causes that cannot be influenced.

• Abellio is consulting with contracting authorities in the UK and Germany on adjusting contracts so that at least a break-even result is achievable in the future. The financial risk for NS is limited to the guarantees issued for the Abellio entities. For a few contracts in the United Kingdom, the financial risk is shared with joint venture partners.
• The total amount of the investments by NS abroad and the guarantees issued by NS for them remains within the maximum of the Capital-at-Risk framework agreed with the NS shareholder. This maximum has already been taken into account in the NS capital structure.

6. HSL South:
The risk of not performing as agreed on the HSL.

Performance and risk management continued to improve in 2020, and the shortage of seats did not occur due to the impact of the COVID-19 pandemic. The KPIs are sensitive to risk factors associated with the complexity of HSL South. The ICNG delivery has been delayed and new arrangements have been made with the Ministry of Infrastructure and Water Management.

• HSL South Improvement Programme is working with ProRail on further measures to improve operational performance. The Ministry of Infrastructure and Water Management’s infrastructure improvement package of €60 million has been extended to the end of 2022, which means that infrastructure quality will lead to fewer train cancellations.
• Close attention is paid to controlled inflow of ICNG and to avoid introduction dips as much as possible.
• New heat guidance has been successfully implemented to keep rolling stock deployable during extremely hot periods, which has ensured that no major outages have occurred this year during the long and extreme heat period.

7. Infrastructure:
The risk that the implementation of the timetable and the realisation of our ambitions (high frequency and speed increase) will be negatively affected by infrastructure bottlenecks.

As a consequence of the postponement of product steps due to the COVID-19 pandemic, there is slightly more room because passenger growth has slowed down and if the (timing of the) product steps is jeopardised, we aim for timely clarity/communication in order to focus on the impact determination and thus manage expectations with stakeholders. This is offset by budget pressures on infrastructure investments and activity (maintenance) delays, which can lead to infrastructure bottlenecks with an impact on our services. Pressure remains on Greater Amsterdam, especially due to the dependency between different projects and the many activities.

• The Medium Term process together with ProRail has been improved and promotes transparency in decision making.

8. IT:
The risk of IT systems failing to meet operational and security requirements.

On balance, the risk has remained the same. Measures are in place to increase control, but threats including cyber risks (including on the train) are now increasing as the threat landscape continues to grow.

• The most important critical systems in train logistics control were replaced in 2019 and 2020, and the major remaining operational legacy systems, including travel information system and Data Warehouse systems, will largely be replaced during the period to 2022. Business continuity agreements with suppliers have been tightened.
• Large systems to be replaced are made as modular as possible for the purpose of future-proofing;
• The IT capacity shortage remains and with it dependence on third parties. To mitigate this, external employees are replaced by in-house employees whenever possible. Agile working within NS will be accelerated in the coming years by means of a transformation plan and is therefore also a mitigating measure.
• Based on a roadmap, cybersecurity will be further strengthened, both in terms of process by means of governance and policy, and substantively in the case of IT and operational technology (OT) on and around the trains. Significant steps have been made in security monitoring, allowing for faster detection of cyber irregularities in the network.
• Awareness campaign concerning secure working from home and extra alertness internal IT security monitoring. Accelerated rollout of resources for working securely at home, including MS Teams.

9. Agility:
The risk of NS failing to achieve sufficient change and innovation capability.

We kept the Netherlands moving during the COVID-19 pandemic and adapted to the new circumstances, proving to be agile and flexible. The financial situation and downward traveller projections demand that we work structurally to make NS smaller and more agile.

• Supported by a Transformation Team, NS is working in a structured manner on cost savings and behavioural change so that we can work together more decisively and respond more quickly to changes. We also promote advancement and retraining so that people remain employable and flexible in the changing context.