Computacenter (CCC) Risk Analysis

Alert status Increased risk of loss, corruption or unauthorised disclosure of personal data commensurate with the increased cyber threat. Risks • Lack of effective pre-contract processes, resulting in poor design, costing and pricing • Lack of effective post-contract delivery • Loss, corruption or unauthorised disclosure of personal data • Lack of effective acquisition integration and failure to deliver on acquisition objectives • Failure to meet our commitments or comply with applicable laws and regulations in relation to environmental, social and governance matters Principal impacts • Customer dissatisfaction • Financial penalties • Contract cancellations • Reputational damage • Reduced margins • Loss-making contracts • Reduced service and technical innovation Mitigation • Mandatory governance processes relating to bids and new business take-ons, including risk-based decision-making assessments and new tooling • Board oversight of significant bids • Early Warning System and assurance provided by the Group Quality Management & Assurance function over key bids and delivery programmes • Regular commercial ‘deep dives’ into troubled contracts and challenging transformation projects • Data privacy audit programme • Appropriate due diligence and acquisition integration plans in place, with ongoing monitoring of key risks to ensure success • Board-endorsed sustainability strategy • Climate Committee oversees initiatives to reduce environmental impact (see pages 52 to 61) • TCFD disclosure (see pages 62 to 64) • Strong Company culture and values (see pages 44 to 51) • Oversight by the Compliance Steering Committee • Strong corporate governance, risk management and ethics, including policies and/or training for anti-bribery and corruption, export compliance, competition law, HSE and HR in addition to a whistleblowing hotline Risk owners • Group Delivery Director • Group Commercial Management Director • Group Legal and Compliance Director • Group Development Director • Group Finance Director • Group Chief People Officer

Alert status Increasing due to the worldwide activity of cyber threat actors including nation states, and the need to replace a number of core systems in the coming years. Risks • Cyber threat to Computacenter’s networks and systems, arising from either internal or external security breaches, leading to system failure, denial of access or data loss. In addition, cyber threats introduced by Computacenter to its customers’ networks and systems, for whatever reason • Major failure(s) leading to unacceptably long outages or regular short outages of our customer-facing systems leading to customer dissatisfaction, financial penalties or contract cancellations, leading to damage to our reputation and ability to win business. Failure to plan and execute effectively the replacement of our core internal systems, leading to loss of business control Principal impacts • Inability to deliver business services • Reputational damage • Customer dissatisfaction • Financial penalties • Contract cancellations Mitigation • Well-communicated Group-wide information security and virus protection policies • Specific inductions and training for employees working on customer sites and systems • Specific policies and procedures for employees working behind a customer’s firewall • Ongoing and regular programme of external penetration testing • Policies ensuring Computacenter does not run customer applications or have access to customer data • Regular review of cyber security controls and threat analysis by Computacenter’s Group Information Assurance team • All Group standard systems built and operated on highavailability infrastructure, designed to accommodate failure of any single technical component • All centrally-hosted systems built and operated on highavailability infrastructure, with multiple levels of redundancy • All centrally-hosted systems benefit from dual network connectivity into core data centers designed to accommodate loss of network service • Standing agenda item for each meeting of the Group Risk Committee Risk owner • Chief Information Officer

Alert status Increased risk in recruitment and retention due to the post-pandemic recovery, resulting in labour shortages. Risks • Failure to recruit and retain the right calibre of employees to our talent pool, which includes acting as an inclusive employer, with a focus on senior positions in sales, services and projects • Inadequate succession planning or insufficient depth within key Senior Executive positions Principal impacts • Lack of adequate leadership • Customer dissatisfaction • Financial penalties • Contract cancellations • Reputational damage Mitigation • Succession planning in place for the top 50 managers across the Group • Regular remuneration benchmarking • Incentive plans to aid retention • Investment in management development programmes • Regular employee surveys to understand and respond to employee issues • Specific diversity projects in place relating to accessibility and wellbeing, life balance, LGBT+ and allies, future talent, focus on women and culture Risk owners • Group Chief People Officer • Chief Executive Officer