Independent auditors’ report continued to the members of NCC Group plc
Report on the audit of the financial statements continued Our audit approach continued Key audit matters continued
Key audit matter
How our audit addressed the key audit matter
Recoverability of goodwill in UK and APAC Cyber Security cash generating unit (group) Refer to notes 2 and 11 in the group financial statements. The carrying value of goodwill at 30 September 2025 is £46.3m (2024: £156.5m). Goodwill of £44.3 million (2024: £44.3 million) is allocated to the UK and APAC Cyber Security CGU. The group’s CGUs are assessed for impairment annually or more frequently if indicators of impairment have been identified. The performance of these impairment reviews require determining the recoverable amounts of the CGUs and comparing these calculations against the carrying values of the groups CGUs. The fair value less cost to sell (“FVLCS”) model utilised to determine the recoverable amount of the UK and APAC Cyber Security CGU required management judgement around determining reasonable market multiples and sustainable earnings assumptions. Given the judgement associated with determining these assumptions, we considered the recoverability of goodwill in the UK and APAC Cyber Security CGU to be of most significance in our audit of the financial statements and therefore we have included this as a key audit matter.
In assessing the appropriateness of management’s impairment assessment for the UK and APAC Cyber Security CGU, we have performed the following procedures: We obtained management’s impairment model and compared the actual results with previous forecasts to assess the historical accuracy of management forecasts. We held discussions and challenged management on the sustainable earnings, in particular focusing on short-term revenue forecasts, and agreed these assumptions to audit evidence. We compared key assumptions around revenue growth rates to external market research on industry market growth rates to identify any inconsistencies. We assessed management’s assumptions for operating margins by comparing to historical data. We considered management bias throughout the assumptions used and considered any contradictory evidence. We engaged our internal valuations experts to review the FVLCS model and assess the assumptions for the market multiple by comparing their assessment against external market data and comparable companies. We evaluated the competency, independence and objectivity of the experts engaged by management who supported management in the determination of the reasonable market multiples. We assessed the mathematical accuracy of the impairment assessment and board approved forecasts. We evaluated the appropriateness of disclosures included in the financial statements. As a result of these procedures, we were satisfied the recoverable amount of the CGU exceeded the carrying amount. In assessing the appropriateness of the investment valuation of NCC Group Holdings Limited, we performed the following procedures: We obtained a schedule of investments in subsidiary undertakings and ensured this is reconciled to the financial statements. We reviewed the assessment of the indicators of impairment and compared this assessment to external market factors, the results of the group’s annual goodwill impairment review and the ongoing Cyber and Escode strategic reviews. We compared the carrying value of the investment to the group’s market capitalisation at the reporting date. We reviewed the disclosures included within note 30 of the financial statements and consider these to be appropriate. As a result of these procedures, we were satisfied with the conclusion that no indicators of impairment were identified. As the group is headquartered and its principal finance offices are in Manchester, United Kingdom, the group engagement team is also based in Manchester. All audit work was completed by the group engagement team. The management reporting units vary in size. We identified one reporting unit (NCC Group Security Services Limited) that required an audit of its complete financial information due to its size. We also identified a further seven management reporting units that required specific audit procedures to be performed over selected financial statement line items which included Fox-IT Holding B.V, NCC Group Security Services Inc, NCC Group Corporate Limited, NCC Group plc, NCC Services Limited, NCC Group (Solutions) Limited, and NCC Group Software Resilience (NA) LLC.
Recoverability of Investments in subsidiary undertakings (parent)
Refer to note 30 in the Company financial statements. The Company financial statements have investment in subsidiaries of £293.2 million (2024: £291.1 million). The investment is held in NCC Group Holdings Limited which subsequently holds an investment in other subsidiary undertakings in the group. An assessment is performed annually to identify whether there are internal or external factors that indicate the investment in subsidiary undertakings may be impaired. If indicators of impairment are identified, the Company would proceed to evaluate the recoverable amount of its investment in subsidiary undertakings. No indicators of impairment were noted by management from their assessment. Given the magnitude of this balance, and the management judgement involved in determining whether any indicators for impairment exist, we have considered the risk of impairment of these assets as a key audit matter. How we tailored the audit scope We tailored the scope of our audit to ensure that we performed enough work to be able to give an opinion on the financial statements as a whole, taking into account the structure of the group and the company, the accounting processes and controls, and the industry in which they operate. The group is split into two main reporting segments being Cyber Security and Escode. These reportable segments are organised into 52 management reporting units in a range of different geographies which are structured mainly across Europe and North America. Certain functions relevant for financial reporting are managed by the group’s head office. The financial statements are a consolidation of the group’s management reporting units and its centralised consolidation entries.
NCC Group plc — Annual report and accounts for the year ended 30 September 2025 100
Made with FlippingBook Online newsletter maker