Principal risks and responses

Inability to identify, prepare for, and adapt to further significant regulatory changes could negatively impact our business and the competitive landscape.

Limited strategic responsiveness to geopolitical and macroeconomic shifts could result in failure to achieve growth and challenges to our ability to service our clients.

Inadequate response to relevant UK or global issues, especially those with a public interest and/or adverse media coverage, along with failure to proactively manage and position the firm’s communications, could negatively impact the firm’s reputation.

Insufficient investment in evolving services/products, including leveraging technology, data, and alliances, to meet changing market and client needs could make us less relevant and competitive, leading to poor business performance.

Insufficient evolution and management of resilient delivery models, including the failure to appropriately use Service Delivery Centres and third parties, could lead to quality issues, delivery disruption, financial and/or reputational risks.

Engaging with an inappropriate client or the delivery of services below expected standards in the UK firm or the wider PwC Network could lead to a significant audit quality failure, resulting in reputational risk, litigation, and/or regulatory action.

Engaging with an inappropriate client or the delivery of services below the expected standards in the UK firm or the PwC Network could result in a significant service quality failure, leading to a potential service failing, significant costs to remedy, reputational risk, perceived or actual conflicts of interest, litigation and/or regulatory action.

Inadequate protection of the firm’s data and technology landscape through the design, implementation, and maintenance of information security capabilities, including security awareness, could lead to accidental data loss through negligence, intentional leakage of the firm’s or our clients’ confidential data by threat actors or reduced defences against ransomware attacks.

Non-compliance with relevant independence, legal, and regulatory requirements (including sanctions, confidentiality, and GDPR) could lead to regulatory action, financial penalties, reputational damage, and/or conflicts of interest.

Inadequate creation and maintenance of appropriate controls and mitigations to manage data and maintain resilient IT infrastructure and applications across the technology ecosystem, including third parties and the Global Network, could hinder the support of the business operations now and in the future.

Ineffective attraction, development, and retention of the talent required to meet our current people and client needs, including creating and maintaining a diverse and inclusive culture, supporting an agile workforce, promoting employee wellbeing, and ensuring compliance with professional requirements and firm procedures, could hinder our ability to deliver effectively and address unacceptable behaviour.

Neglecting to adapt people strategies today to be ready for changes in employee expectations and business models in the future, including: offering an appealing proposition to future talent, developing necessary skills and leaders, adapting to changing technology and business processes, maintaining firm culture, and implementing strategic workforce planning, could restrict our ability to attract and retain the right talent, hinder the development of future business skills and leaders, and negatively impact our ability to anticipate and adapt to changing people and client needs.

Inadequate business and financial management and lack of adaptability to internal and external forces impacting the business, including macroeconomic developments, changing market conditions and evolving delivery models, could result in an ineffective or sub optimal response to financial pressures, leading to constrained growth and profitability, working capital pressures, and reduced financial resilience to withstand a crisis.

Inadequate mitigation and response to the effects of climate change and environmental degradation on our operations and our work with our clients, including failure to transition our business (including SDCs) to adapt, fulfil climate and environmental commitments, or comply with regulatory requirements, could negatively affect our operations and reputation.

Inability to capitalise on opportunities from the PwC Network operating model, to work effectively with our subsidiaries and strategic alliances, and/or to manage the risks arising from the actions of other Network firms, could result in reputational risks, overseas litigation, and/or regulatory action.

Inability to scale AI fluency, modernise services, evolve our investment approach, and build effective go-to-market capabilities could limit our ability to compete in an AI-driven market. This might diminish our relevance to clients, weaken our competitive edge, and restrict future growth.