LEGAL AND REGULATORY LEGAL AND REGULATORY FINANCIAL
Social change, legislation and regulation Data security & privacy Financial reporting
Non-compliance resulting in litigation or negative public
relations, and effects on our margins due to restrictive (or
changing) laws and regulations. Risk events may include:
• Gig economy (independent courier contractor model vs.
courier employment model)
• Food legislation / tax (HFSS)
• Payment Service Directive 2 (Directive 2015/2366/EU on
payment services) regulations
• New taxes
• Climate change, environmental impacts and opportunities.
Main actions and controls
• Maintaining sufficient policies and procedures to comply with
the Payment Services Directive 2 (Directive 2015/2366/EU on
payment services) related rules and regulations,
• Second-line and third-line functions monitor emerging, new
and evolving risks,
• Engaging external specialists to assist in adherence to laws
and regulations,
• Establishing project teams to address significant legislative
changes,
• Taking proactive ‘gig economy’ measures,
• Development of climate risk framework (refer to Our
Responsible business and Sustainability approach section for
more information).
Potential impact
Non-compliance could lead to fines, litigation, reputational
damage, regulatory intervention, revocation of the license of
Takeaway.com Payments, all could cause a material adverse
impact on our reputation, business, results of operations,
financial condition, and reputation.
Sensitive commercial & privacy data may be used and / or
retained without authorisation/against the law, or is stolen.
Main actions and controls
• Periodic reassessment of privacy related risks and controls,
• Growing second line teams and systems to address risks,
• Recurring privacy, data protection, and Information Security
awareness trainings,
• Privacy council in place to address privacy-related concerns,
controls, events, etc.,
• New GRC software tool which will ensure more effective
monitoring and reporting on information security risks,
• Information Security addressing privacy data risks and
following up on security threats.
Potential impact
Non-compliance could lead to regulatory fines, claims or
litigation which may lead to a material adverse impact on our
reputation, business, results of operations, financial condition,
and prospects.
The leakage of sensitive commercial data could lead to a
material adverse impact on our results of operations, financial
condition, and reputation.
Being a multi-exchange listed company raises the risk of not
being able to meet all regulatory requirements. In addition,
material errors in our financial reports (including
disclosures), intentional or not, may not be discovered (on
time), either at group or subsidiary level.
Main actions and controls
• Various monitoring layers to review (non-)financial reports are
in place,
• ISAE 3402 / 3000 effectiveness testing performed on
selected controls in the order-to-cash and general IT
processes (Including those related to revenue recognition),
• Added more seniority / resources to the Finance teams,
• Central accountability for SOx 404 agreed and project
management established,
• Senior management review material balances, complex
judgements and financial controls giving ongoing
improvement input to the Finance teams,
• Finance transformation project ongoing to improve quality
and timeliness of financial reporting processes.
Potential impact
Unintentional misstatements or manipulation couldb adversely
affect our relationships with various stakeholders and therefore
materially adversely impact our reputation, business, results of
operations, financial condition, and prospects.
Risk severity trend compared
to prior year:
Risk severity trend compared
to prior year:
Risk severity trend compared
to prior year:
Severity of risk, considering mitigation actions, is lower No change to severity of risk Severity of risk, considering mitigating actions, is higher
153Just Eat Takeaway.com Annual Report 2021
Risk management