Diageo (DGEAF) Risk Analysis

Diageo relies on information technology (IT) systems, networks and services, including internet sites, data hosting and processing tools, hardware (including laptops and mobile devices), software, and technical platforms and applications, to process, store and transmit large amounts of data and to help it manage its business. Diageo uses its IT systems, networks and services for, among other key business functions, the hosting of its primary and brand-specific websites and its internal network and communications systems; supply and production planning, execution and shipping; the collection and storage of customer, consumer, IR and employee data; processing various types of transactions, including summarising and reporting its results of operations; the development and storage of strategic corporate plans; and ensuring compliance with various legal, regulatory and tax requirements. As with all large systems, Diageo’s IT systems, including those managed or hosted by third parties, could be subject to sophisticated cyber-attacks (including phishing and ransomware attacks) and IT threats by external or internal parties intent on disrupting production or other business processes or otherwise extracting or corrupting information. In recent years, ransomware attacks against some of Diageo’s peers have become more frequent, which has increased the likelihood of Diageo being targeted for a similar cyber-attack. Diageo’s vulnerability to such cyber-attacks could also be increased due to a significant proportion of its employees working remotely during the course of the Covid-19 pandemic. Unauthorised access to Diageo’s IT systems could disrupt Diageo’s business, including its beverage alcohol and other production capabilities, and/or lead to theft, loss or misappropriation of critical assets or to outside parties having access to confidential or even highly confidential information, including privileged data, personal data or strategic information of Diageo and its current or former employees, customers and consumers. Such information could also be made public in a manner that harms Diageo’s reputation and financial results and, particularly in the case of personal data, could lead to regulators imposing significant fines on Diageo. Diageo’s use of shared business services centres, located in Hungary, Colombia, the Philippines and India, to deliver transaction processing activities for markets and operational entities also means that any sustained disruption to a centre or issue impacting the reliability of the information systems used could impact a large portion of Diageo’s business operations. The captive shared business services centres in Hungary and India also perform certain central finance activities, including elements of financial planning and reporting, treasury and HR services. Any transitions of transaction processes to, from or within shared business services centres, as well as other projects which impact Diageo’s IT systems, could lead to business disruption. In addition, if Diageo does not allocate and properly manage the resources necessary to build, sustain and protect these centres or its wider IT systems, it could be subject to losses attributable to processing inefficiencies, the unexpected failure of computer systems, devices and software used by its IT platforms, production or supply chain disruptions, the unintended disclosure of sensitive business or personal data and the corruption or loss of accounting data necessary for it to produce accurate and timely financial reports. In certain circumstances, such disruptions or failures could also result in property damage, breaches of regulations, litigation, legal liabilities and reparation costs, thereby having a material adverse effect on Diageo’s business and financial results. International and domestic security risks including terrorism, as well as natural hazards, also pose a threat to the safety of Diageo’s employees and third parties at its sites and events, as well as its property and products. Diageo operates production facilities around the world. If there was a technical failure, or a fire, explosion, flood or other significant event, at one or more of Diageo’s production facilities, this could result in significant damage to the facilities, plant or equipment, their surroundings and/or the local environment and/or injury or loss of life. Such an event could also lead to a loss of production capacity, result in regulatory action or legal liability, and/or damage Diageo’s reputation. Diageo has a substantial inventory of aged product categories, including scotch whisky, which may mature over periods of up to 30 years or more. A substantial portion of this maturing inventory is stored in Scotland, and the loss through contamination, fire or other natural disaster of all or a portion of the stock of any one of those aged product categories could result in a significant reduction in supply of those products, and consequently, Diageo would not be able to meet consumer demand for those products as such demand arises. There can be no assurance that insurance proceeds would cover the replacement value of Diageo’s maturing inventory or other assets in the event that such assets were lost due to contamination, fire or natural disasters, destruction resulting from negligence or the acts of third parties, or any failure of information systems or data infrastructure.