A business must take risks to create value. Having a risk management assessment in place allows a company to take risks in a managed and controlled manner. Strategic, operational, financial, and reputational risks are made controllable by carefully weighing risks and returns against each other. Effective risk management is integrated into our daily operations.
Q-Park deploys a top-down risk management assessment in which strategic risk management is executed at corporate level. Responsibility for operational risk management lies primarily with local country management. The Management Board bears ultimate responsibility for managing the risks that the company faces.
Risk management and internal control
Ongoing identification and assessment of risks is part of our governance and periodic business review. Our Enterprise Risk Management (ERM) assessment and Compliance Programme are designed to provide management with an understanding of the key business risks. It also provides methods and processes to manage the risks that might hamper the business in delivering on our strategy.
Q-Park is averse to the risk of non-compliance with relevant laws and regulations, our own codes, contractual agreements and certain covenants. As legislation and other formal guidelines cover various functional areas and can be very extensive (even country-specific), compliance is managed in a structured way. Our Compliance Programme covers most relevant compliance areas for Q-Park, ensuring:
the tone at the top regarding the importance of compliance;
that the actions per step of the risk control cycle are executed based on a clearly defined plan with clear roles and responsibilities;
that implementation of relevant legislation and internal guidelines within the organisation is assured.
The Executive Board and key management periodically review the risks and related mitigation controls and procedures of the ERM assessment and Compliance Programme and reconsider the identified focus areas. Furthermore, they provide complementary insights into existing and emerging risks that are subsequently included in the policy. The ERM assessment and Compliance Programme determine the formation of controls and procedures, and the focus of business planning and performance process.
Significant developments and risk focus areas in 2021 have been:
The coronavirus pandemic and related governmental mobility restrictions continued to impact our business and financial results. Restrictions have been in place throughout 2021 and varied from full lockdown situations to closing retail, bars and restaurants. Furthermore, leisure activities and (mass) events have been halted for most of the year and working from home was the advised standard. As our business is largely built around the availability of amenities in the vicinity of our facilities, the pandemic and related restrictions have been critical to our performance and constitute a significant risk to our business. On the positive side, in 2021, we experienced a strong recovery of our short-term parking revenues during periods in which restrictions were eased and our customers immediately returned to our parking facilities.
Information security and cybersecurity risks are key risks to which our company is exposed as a result of both our digitisation strategy and the general trend of increasing cybersecurity threats. Based on an initial risk assessments conducted in 2019, an extensive information security programme was launched which covers ‘people’, ‘process’ and ‘system’ angles to bring our information security maturity to a higher level. In 2020 and 2021 information security risks were reduced by strengthening our ICT infrastructure (hosting platform, connectivity platform, end user equipment), ICT organisation and processes. A continuous e-learning programme including theoretical modules, assessments and phishing campaigns is implemented for all Q-Park employees. In 2021 an update of the 2019 cybersecurity and GDPR review was performed identifying key focus points and priorities. Based on this update we will proceed in strengthening our ICT infrastructure by improving cybersecurity awareness, developing business continuity plans and setting up improved asset management processes to detect and protect our assets.
Factors which determine the risk appetite include the international footprint of the business, the robustness of the balance sheet, long-term duration of contracts, strength of cash flows and a commitment to conservative financial management. Our risk appetite varies per objective and risk category:
Strategic: Taking strategic risks is an inherent part of how we do business. In pursuing growth as a strategic ambition, we are prepared to take risks in a responsible way, taking account of our stakeholders' interests.
Operational: Depending on the type of operational risk, we take a cautious to averse approach. We give the highest priority to ensuring the safety of our employees and customers, to delivering the desired level of service, and to protecting the company's reputation.
Financial: We pursue a conservative financial strategy, including a balanced combination of self-insurance and commercial insurance coverage.
Compliance: We are averse to the risk of non-compliance with relevant laws or regulations (like GDPR), or non-compliance with our own codes, contractual agreements, and financial covenants. A dedicated compliance function monitors relevant compliance areas and controls the execution of the Compliance Programme.
Fraudulent and unethical behaviour: We are committed to act with honesty, integrity, and respect. We apply a zero-tolerance policy to fraudulent behaviour. Integrity training is a focus point of our compliance area ‘Ethics & Integrity’.
The following risk overview highlights the main risks which might prevent us from achieving our strategic, operational, and financial objectives. The list is not exhaustive and there may be additional risks which do not constitute a direct threat in the short-term or which management deems immaterial or otherwise common to most companies, but which could at some time have a material adverse effect on our financial position, results, operations, or liquidity.
Q-Park risk management measures
National or local governments could implement measures which are potentially unfavourable to the parking sector (e.g. introduction of low emission zones, electric vehicle charging requirements and banning of traffic within inner-city boundaries).
Factors that potentially influence parking revenues (prices and/or mobility) include pressure from the general public and retailers, political changes, high inflation or a material GDP decrease. Lower parking revenues could significantly impact Q-Park’s profitability and cash flows, particularly in situations where lower parking prices will not result in more transactions.
Competitive environment and economic
The parking market (new business) is characterised by competition between a limited number of existing players. In addition, technology is used increasingly in the parking market which results in new competitors with a possible negative impact on Q-Park's financial results.
Dependency on other businesses and
Car parking services are indirect services which depend on external factors (e.g. offices, shopping centres, leisure amenities). New customer behaviour (e.g. online shopping, working from home) or changes in the popularity of certain stores, locations or areas pose a risk of a decrease in parking demand and, hence, a decrease in Q-Park’s business and revenue.
Risk management measures
A pandemic outbreak in combination with government measures that restrict mobility of people can significantly impact our business and financial results as we are dependent on the availability and accessibility of the amenities in the vicinity of our parking facilities.
Safety and liability
The safety of our customers and employees is our top priority. If an employee or a customer sustains injury while at work or while visiting one of the Q-Park parking facilities, this could also impact our reputation.
Dependency risks, interruptions, and
Continuity of the company and its business is crucial. Continuity depends on a number of factors, including suppliers. We are particularly vulnerable regarding Parking Management Systems (PMS), ICT, and infrastructure which are to a large extent provided by third party suppliers.
Staffing and retention
Good, experienced, and knowledgeable people are the foundation of our company and its success. The company must ensure that it is able to employ and retain the right people.
Ethics and integrity
Ethics and integrity are important conditions for confidence in the company. Behaviour deemed to be unethical could lead to loss of revenue and reputation.
Risk management measures
Valuation of fixed assets and goodwill
The company owns a considerable amount of property and goodwill. If the economic climate deteriorates this could result in a permanent reduction in the value of assets. If potential impairment indicators are not identified, determined, or communicated in a timely fashion, the company could incur reputational and financial damage.
Given that the nature of the business is capital-intensive, access to external financing is crucial for continuity. A liquidity risk could arise if external financing is not available to the company when refinancing is required.
Interest rate risks
The external debts can be subject to variable interest rates, thereby exposing the company to fluctuations in interest rates. A significant increase in variable interest rates would have a negative impact on results.
The company's functional currency is the euro. Given that the company also operates in the United Kingdom and Denmark, we are exposed to fluctuations in the GBP and DKK exchange rates.
Compliance and reportingDownload data
Risk management measures
Financial statement does not give a true
and fair view
If misstatements are made such that the financial statements do not give a true and fair view of the company's financial position, financial performance, and cash flows, users of the financial statements would be incorrectly informed.
ICT and information security
Given the increasing use of online communication and the professionalism of cybercriminals, the company must focus constantly on continuity of ICT systems and on ensuring the security of crucial information and sensitive customer data (e.g. payment card details, passwords). A successful attack or hack by cybercriminals could cause reputational and financial damage and impact business continuity.
Non-compliance with European and
Changes in the legal and regulatory environment tend to increase the risk of non-compliance with local, national, and international laws and regulations, as well as tax legislation. Failure to comply with applicable regulations could lead to fines, claims, and reputational damage.