Governance and Assurance

The group maintains oversight of key risks through periodic review, defined approval levels for higher-risk commitments, and incident escalation routes. Where appropriate, remediation actions are tracked to closure.

Portfolio companies are expected to identify and manage conflicts of interest, including perceived conflicts. The group expects early disclosure, documented decisions where needed, and escalation for review when the right course of action is unclear.

The group applies baseline security controls across the portfolio, including access governance, confidentiality expectations, and practical safeguards proportionate to risk. Where third-party service providers are used, portfolio companies are expected to require reasonable security and confidentiality commitments and to monitor material suppliers.

The group expects portfolio companies to handle personal information lawfully, fairly, and for defined purposes. The aim is to collect only what is needed, to keep it secure, and to provide a clear route for privacy enquiries and requests.