OUR ASSURANCE PLAN 2016/17 MARCH 2016. 1 Our Assurance Plan 2016/17

OUR ASSURANCE PLAN 2016/17 MARCH 2016 1 Our Assurance Plan 2016/17

ABOUT THIS DOCUMENT We publish a range of information about our services and performance. This helps to provide our customers and stakeholders with assurance that we are delivering what they have told us they need and want from their water and sewerage company. It is important that we have robust governance and assurance arrangements in place to ensure that this information is accurate, clear and transparent. In doing so we will continue to provide stakeholders with trust and confidence. These arrangements have been developed in line with Ofwat s company monitoring framework (published in June 2015) which describes how it intends to oversee the information water companies provide to customers over the period 2015-20. The company monitoring framework allows Ofwat to assign each water company to one of three categories of assurance: Self-assurance. Companies that, apart from the base requirements that apply to all companies, have discretion to deliver self-assurance in relation to the additional assurance arrangements they put in place. Targeted assurance. Companies that have not consistently met the high standards that customers and other stakeholders expect are subject to targeted assurance requirements, to ensure that the assurance arrangements they put in place are sufficient to protect customers. Prescribed assurance. Companies that have not provided Ofwat with sufficient confidence about their ability to deliver, monitor and report performance, will have assurance requirements that are prescribed for all information that the company is required to publish, in order to protect customers. Most companies including Northumbrian Water Group (NWG) have initially been assessed for targeted assurance. This means we need to engage closely with our customers and stakeholders to identify key risks and areas of weakness and to consult on our draft assurance plans before publishing final assurance plans. In November 2015, we published our consultation on our risks, strengths and weaknesses and draft assurance plan. This consultation ended on 15 January 2016 and based on the feedback received we committed to publish our assurance plan by the end of March 2016. This document sets out NWG s assurance plan for 2016/17. Our assurance plan will be reviewed and updated on an annual basis. 2 Our Assurance Plan 2016/17

CONTENTS Who we are 4 of our assurance approach 5 Assurance Framework 7 of our risks, strengths and weaknesses 10 Our Assurance Plan for 2016/17 13 3 Our Assurance Plan 2016/17

WHO WE ARE Northumbrian Water Group provides; Water and sewerage services to 2.7 million people in the north east of England trading as Northumbrian Water. Water services to 1.8 million people in the south east of England trading as Essex & Suffolk Water. Our vision Our vision is to be the national leader in the provision of sustainable water and wastewater services. Our values As important as what we do, is doing it the right way. This is driven by our company values which are: Customer focused. We aim to exceed the expectations of our internal and external customers. Results driven. We take personal responsibility for achieving excellent business results. Ethical. We are open and honest and meet our commitments with a responsible approach to the environment and our communities. Creative. We continuously strive for innovative and better ways to deliver our business. One Team. We work together consistently, promoting co-operation, to achieve our corporate objectives. These values underpin our approach to delivering assurance. 4 Our Assurance Plan 2016/17

SUMMARY OF OUR ASSURANCE APPROACH 5 Our Assurance Plan 2016/17

SUMMARY OF OUR ASSURANCE APPROACH We have well established governance and assurance arrangements, in the form of an assurance framework, which we use to ensure that our information is of appropriate quality. The diagram overleaf illustrates the tiers of assurance in place at Northumbrian Water, including: Board Oversight. The Board has ownership of the arrangements for governance and assurance of regulatory submissions and reporting. This is monitored and controlled through the Board s Audit Committee and Risk & Compliance Committee with regular reporting by the committees to the Board. Risk Management. We use a data risk assessment, and a risks, strengths and weaknesses review as part of our regulatory reporting processes, to determine levels of risk and target assurance activity. This is a robust and mature process and is embedded within the company s mature risk management processes. The Board sets the tone for risk management, determines the appropriate risk appetite, monitors the management of fundamental risk and approves major decisions affecting the company s risk profile. Management Assurance. Our Management Team implements the Board s strategies and closely monitors performance. This includes ensuring that sufficient and suitable resources (human and financial) are applied to scrutinise performance and identify and manage risk. The Management Team ensure there is appropriate assignment of responsibilities, corporate structures and reporting lines and accountabilities, supported by annual positive assurances on systems and controls. Business Assurance. We have many teams who are separate from the operational activities which monitor, capture and manage the data we report. Specifically this includes our Internal Audit Team. Accountable directly to the Audit Committee, this team provides strong, independent assurance. As such their remit sits across this tier and the following one. Independent Assurance. Our business assurance teams are supplemented with external specialist providers where we require technical and/or external assurance. 6 Our Assurance Plan 2016/17

ASSURANCE FRAMEWORK BUSINESS ASSURANCE TEAMS Health, Safety, Environment and Quality Performance and Information Economic Regulation Wastewater Compliance Water Quality Business Continuity Scientific Services Accreditation Team Information Systems Security Internal Audit INDEPENDENT ASSURANCE Numerous external assurance providers including the likes of: Deloitte (financial auditor) AFNOR (external accreditation) KPMG (internal audit co-source partner) External technical auditor (business continuity and regulatory reporting) INDEPENDENT ASSURANCE BUSINESS ASSURANCE TEAMS MANAGEMENT ASSURANCE RISK MANAGEMENT RISK MANAGEMENT BOARD OVERSIGHT ACTIVITIES BOARD OVERSIGHT Board Remuneration Committee Risk and Compliance Committee Audit Committee RISK MANAGEMENT Strategic Risk Model Corporate Risk Model (supported by a strong risk management framework) Detailed Risk Model Data Risk Model Risk Champions Assurance Forum MANAGEMENT ASSURANCE Departmental Compliance Programmes Management Team and its sub-groups Systems Controls 7 Our Assurance Plan 2016/17

This assurance framework was applied to our 2015-2020 business plan and enabled our Board to satisfy itself that the information associated with the development of our performance commitments was robust. The same framework will apply to the information needed to report our performance against these commitments. A critical part of this framework is our approach to risk management which includes the following steps: Understanding how data for each measure of success is managed from the point at which it is collected in the field, through the way it is collated in order to appear on a final report; Applying a formal risk assessment to each measure of success. This reviews: The likelihood of a reporting error due to the complexity of a performance measure and the manner in which the data is collected. The impact should an error occur, particularly with regard to customers trust and confidence, financial incentives and our reputation. Checks and balances, in the form of data quality controls are used to mitigate risks. These controls may be procedural, audit based, or built into our IT systems. We review the effectiveness of these controls as part of our risk assessment and they are rated as good, acceptable or ineffective. We have also conducted a wider assessment of the risks, strengths and weaknesses exercise associated with providing robust information, taking account of: A review of our assurance arrangements by KPMG, including a deep dive into information relating to three measures of success. Our business as usual conversations with our key stakeholders. The relationship we have with our key stakeholders is important to Northumbrian Water. We actively engage with stakeholders to ensure that we maintain trust and confidence. Our key stakeholders in this context are: Our Water Forums (Customer Challenge Groups). The Consumer Council for Water (CCWater). Ofwat. The Drinking Water Inspectorate (DWI). The Environment Agency (EA). This engagement is achieved via regular conversations and performance review meetings with these stakeholders, understanding their expectations relating to data reporting and communications, whilst being open to constructive feedback. The results of KPMG s review, along with our stakeholder conversations, have been used to inform our draft Assurance Plan. Based on the feedback received from our consultation we have extended the scope of our assurance plan to include by exception key delivery risks in addition to consideration of data quality and integrity. An internal review of our corporate risk register has identified significant risks associated with either the delivery of our performance commitments or with meeting new or emerging requirements. 8 Our Assurance Plan 2016/17

This approach has identified the following areas for inclusion in our final assurance plan: Outcome performance reporting. How we intend to meet our challenging performance commitments for pollution and sewer flooding. Assurance for meeting market readiness which comes into force in April next year. The implementation of a new consolidated customer information and billing system. Meeting our commitments in relation to new reporting requirements for developer services. The diagram below provides an overview of the approach we have undertaken in developing our risk assessment. EXTERNAL ENGAGEMENT AREAS OF RISK INTERNAL REVIEW Continuous stakeholder engagement Consultation on risks, strengths and weaknesses Regulatory guidance and feedback Consequence Outcome performance reporting Pollution and sewer flooding commitments New obligations for the retail market New consolidated customer information and billing system New obligations for developer services Identification of risks associated with: Quality of information Achievement of our performance commitments New obligations Likelihood 9 Our Assurance Plan 2016/17

SUMMARY OF OUR RISKS, STRENGTHS AND WEAKNESSES 10 Our Assurance Plan 2016/17

SUMMARY OF OUR RISKS, STRENGTHS AND WEAKNESSES Strengths Our well established, mature and well understood Governance and Assurance Framework has been applied to the reporting of our performance commitments. This includes a data risk assessment which has been used to target the nature and level of assurance activity in the most appropriate way. The framework has been assessed by KPMG as consistent with regulatory expectations and deep dives conducted by KPMG into three areas of performance have all resulted in a green assessment: Robust methodology and robust controls in place. No major issues expected. This framework also builds upon our integrated management system and commitment to quality assurance. We have companywide accreditation to the following standards which has been in place for a number of years: ISO 9001. A quality management system ISO 14001. An environmental management system OHSAS 18001. An occupational health & safety management system In addition our sampling and laboratory analysis are accredited to the demanding ISO 17025 standard, and from 2015 we also have companywide accreditation to IS0 55001 for Asset Management A further strength is our excellent, strong and mutually beneficial relationships with our key stakeholders. Risks Outcome performance reporting Many of our performance commitments for 2015-2020 have financial incentives associated with them in the form of penalties and rewards. This is a new arrangement, and we are very aware of the adverse impact that miscalculating incentives could have on our reputation and stakeholder trust and confidence, along with the potential for associated fines. These impacts are likely to be more significant than the actual monetary value of any penalty or reward being incorrect. This risk has been reflected in our data risk assessment exercise, the results of which have enabled us to target assurance and mitigation activities in the most effective way. Pollution and sewer flooding commitments Based on recent performance our pollution performance commitment is challenging and there is a need to focus on maintaining recent improvements in our sewer flooding performance. Our strategy, operational and delivery teams will continue to focus on developing a pollution action plan and embedding our sewer flooding action plan to ensure that targets are achieved. New obligations for the retail market From April 2017, non-household customers across England and Wales will be able to choose their supplier for water and wastewater services. In readiness for the market opening, we will need to provide assurance that we have met the requirements of these new arrangements which includes confirmation of hitting key milestones. New consolidated customer information and billing system We rely on our IT systems for the majority of information required to monitor our performance. Consistent with our business plan, we are planning substantial improvements to these systems during the 2015 to 2020 period. Most significantly this includes a new customer information and billing system and systems to support retail separation. It is important that we retain a strong focus on data quality when we make these changes, in order to avoid any adverse impact on performance commitment reporting. 11 Our Assurance Plan 2016/17

New obligations for developer services Water and sewerage companies provide a range of developer services to enable new connections to the network. We already offer developers a high quality service and our approach of early collaboration with them and local planning authorities is very supportive and ensures that our water and sewerage infrastructure planning is closely aligned to future housing and economic development plans. We, along with other water and sewerage companies, now report our performance so that customers can compare the standard of service they receive from the industry. This is an area that we want to focus assurance activity on in order to meet statutory obligations and improve services to developers. Weaknesses In future, in addition to reporting on our performance in the previous year, we will need to share forecasts of likely outcomes on penalties and rewards. We have a forecasting methodology which we use for internal purposes, but the processes and controls for producing reliable forecasts are fundamentally different to those used in recording and reporting on actual information and data as are the assurance requirements. We will need to consider whether additional assurance may be required to support the new requirement to publish these forecasts externally. Within the context that each area received an overall assessment of green, there are a limited number of recommendations from KPMG in relation to their deep dive exercise which we have incorporated into our draft assurance plan. 12 Our Assurance Plan 2016/17

OUR ASSURANCE PLAN FOR 2016/17 13 Our Assurance Plan 2016/17

OUR ASSURANCE PLAN FOR 2016/17 The following tables contain our assurance plan for 2016/17. This details how the outcome from the data risk assessment exercise, and the wider assessment of risks, strengths and weaknesses, has been used to target our planned assurance activity. PERFORMANCE COMMITMENTS Interruptions to water supply DESCRIPTION RISK BASED REVIEW PLANNED ASSURANCE ACTIVITIES This measure is calculated using the total duration of all water supply interruptions of more than three hours divided by the number of properties the company supplies to give an average interruption time in minutes and seconds per year. The measure includes planned interruptions, unplanned interruptions and interruptions caused by the actions of third parties, for example resulting from a power cut The measure will be assessed on the company s regulatory year performance. The risk assessment found a mature process with regular data quality monitoring along with senior manager scrutiny throughout the year. Performance is also monitored monthly by Management Team and Board. Previous audits have found some minor inaccuracy in time recording (with a non-material effect on overall performance). A re-organisation of our water service team is underway. We need to ensure that responsibilities for the provision of data are considered as part of this. We have separate IT systems (Northumbrian and Essex & Suffolk) which are being aligned. Overall the assessment of data quality controls for this measure is acceptable. This is a high priority for assurance, it is important that all data quality controls are working effectively. Areas to target The risk based review identified that highest risk to quality of data lies in areas of manual data collection. Our external technical auditor will carry out an audit of our methodology, processes, data quality and final numbers. The audit will also include sampling of data from report back to source paying special attention to data which is collected manually. Our internal audit team will conduct system audits during the year. KPMG observations from deep dive exercise: Risks The main area of potential risk comes from manual collection of data prior to entering into our IT systems. Strengths Processes have been carefully mapped and relevant controls identified. There is a robust challenge and review process, and a high awareness of the team on the relevance of data quality that translates into regular challenges on data accuracy before it is entered into our IT systems. This is a complex measure with financial incentives attached and as such is a high priority for assurance. 14 Our Assurance Plan 2016/17

PERFORMANCE COMMITMENTS Sewer flooding - includes internal and external flooding and repeat flooding DESCRIPTION RISK BASED REVIEW PLANNED ASSURANCE ACTIVITIES These measures track the number of properties which have been affected by an escape of sewage from the company s network. We have separate performance commitments for properties which are affected internally and externally. We also report separately on flooding incidents caused by assets which transferred into water company ownership in October 2011. There is a further performance commitment for repeat flooding incidents. Previous audits have found year on year improvement in data and no recent material issues. The risk assessment found a mature process with regular internal data quality monitoring along with senior manager scrutiny throughout the year. Performance is also monitored monthly by Management Team and Board. The risk assessment found good data quality controls in place. Our historic performance has been challenging, there is a need to focus on maintaining recent improvements in service. KPMG observations from deep dive exercise: Risks The main area of potential risk is assessing and categorising flooding incidents correctly on the ground followed by collating and aggregating the data to report performance. The former is conducted by our sewerage teams, the latter by our performance and information team. These two teams have the appropriate expertise to carry out these functions. Interaction between these teams is crucial for this approach to work. This is a high priority for assurance, it is important that all data quality controls are working effectively. Areas to target The risk based review identified that the highest risk to data quality lies in assessing flooding incidents and categorising them correctly. Our internal audit team will conduct system and data quality audit. The audit will also include sampling of data from report back to source during the year and reporting of final numbers. In addition given the performance challenge, our strategy, operational and delivery teams will continue to focus on our action plan to maintain recent improvements in performance levels. Strengths The process has been carefully developed and documented with data quality controls in the main areas of risk. One of the main focuses of our new sewer flooding team is to ensure data relating to our performance commitments is robust and carefully checked. These are complex measures with financial incentives attached and as such are a high priority for assurance. 15 Our Assurance Plan 2016/17

PERFORMANCE COMMITMENTS Customer surveys includes surveys undertaken by CCWater and other independent bodies DESCRIPTION RISK BASED REVIEW PLANNED ASSURANCE ACTIVITIES There are various surveys conducted that ask customers independently about their overall satisfaction with the service the company provides. Overall customer satisfaction. Keeping customers informed. Domestic customer satisfaction (Net Promoter Score). Value for money (water). Value for money (sewerage). These surveys are carried out by accredited external organisations (e.g. Explain) and recognised industry bodies (e.g. CCWater). The risk assessment found good data quality controls in place. KPMG observations from deep dive exercise: (Based on one parameter - Net Promoter Score) Risks Reputational measures are not always under the full control of the company and may be influenced by external factors. This is a low priority for assurance. No additional assurance required. Service Incentive Mechanism (SIM) The SIM measure indicates the level of customer satisfaction with company service. It comprises a combined score of quantitative (volumes of complaints) and qualitative (survey) figures. There is an associated penalty and reward set by Ofwat. Strengths When performing surveys, Explain uses a robust sampling methodology based on best practices in the industry. The company regularly reviews the quality of the data collection process. This is a low priority for assurance. Previous audits have found no material issues. The risk assessment found a mature process which is carefully controlled with procedures in place for regular data quality monitoring. Performance is also monitored monthly by Management Team and Board. The risk assessment found good data quality controls in place. This is a complex measure with financial incentives attached and as such is a high priority for assurance. This is a high priority for assurance, it is important that all data quality controls are working effectively. Our internal audit team will conduct a system and data quality audit. The audit will also include sampling of data from report back to source during the year and reporting of final numbers. Overall drinking water quality This is our overall drinking water quality compliance based on 39 water quality parameters determined by the Drinking Water Inspectorate. Previous audits have found a mature process with no material issues. The risk assessment found water quality sampling, analysis and data recording covered by a rigorous quality system assured by UKAS (the UK Accreditation Service). Reporting is performed directly from our Laboratory Information Management System and is also monitored monthly by Management Team and Board. The risk assessment found good data quality controls in place. This is a high priority for assurance, it is important that all data quality controls are working effectively. Continuing UKAS certification, which covers sampling, laboratory and data audits. Our external technical auditor will audit data extraction, interpretation and reporting. This is a complex measure with financial incentives attached and as such is a high priority for assurance. 16 Our Assurance Plan 2016/17

PERFORMANCE COMMITMENTS Pollution incidents DESCRIPTION RISK BASED REVIEW PLANNED ASSURANCE ACTIVITIES This measure is the number of category 3 pollution attributable to our operations. It includes the total number of category 3 pollution events from a discharge or escape of a pollutant from the company s water and sewerage assets affecting rivers or coastal waters. A portion of the reported number relies on self reporting to the Environment Agency (EA) by the company. The EA then store pollution data in their database and are responsible for reporting performance. Previous audits have found no material issues. The risk assessment found a well established self reporting process and detailed and comprehensive records. Performance is also monitored monthly by Management Team and Board. The found good data quality controls in place. Based on recent performance this is a challenging commitment to achieve. This is a high priority for assurance. Our external technical auditor will review our methodology and data quality. This will include sampling of data from source to final report and cross checking of the final numbers with the EA s list. In addition given the performance challenge, our strategy, operational and delivery teams will focus on the development and implementation of an action plan to ensure targets are achieved. This measure has financial incentives attached and is a challenging performance commitment to achieve, so is a high priority for assurance. Satisfaction with taste and odour of tap water This is the number of complaints received from customers because they are dissatisfied with the taste or odour of their tap water. The measure matches Drinking Water Inspectorate reporting guidance. Previous audits have found no material issues. The risk assessment found a mature process with data entered into corporate systems and extracted directly from systems to provide performance reports. Performance is also monitored monthly by Management Team and Board. The risk assessment found good data quality controls in place. This is a medium priority for assurance. Our internal audit team will conduct a system and data quality audit. The audit will also include sampling of data from report back to source during the year and reporting of final numbers. This measure has financial incentives attached and so even though controls were found to be robust it remains a medium priority for assurance. Discoloured water complaints This is the number of complaints received from customers because they are dissatisfied with the appearance of their water because it is discoloured; described as black, orange or brown. Previous audits have found no material issues. The risk assessment found a mature process with data captured and recorded directly into corporate systems. The data is then stored and reported directly out of corporate systems with senior manager scrutiny throughout the year. Performance is monitored monthly by Management Team and Board. The risk assessment found good data quality controls in place. This is a medium priority for assurance. Our internal audit team will conduct a system and data quality audit. The audit will also include sampling of data from report back to source during the year and reporting of final numbers. This measure has financial incentives attached and so even though controls were found to be robust it remains a medium priority for assurance. 17 Our Assurance Plan 2016/17

PERFORMANCE COMMITMENTS Sewer collapses DESCRIPTION RISK BASED REVIEW PLANNED ASSURANCE ACTIVITIES This measure counts the number of collapsed sewers that we experience. We report separately on collapses relating to assets which transferred into water company ownership in October 2011. Previous audits found no material issues. The risk assessment found complex definitions, with reliance on information from 3rd parties. The number of collapses experienced, however, is low. This means that occurrences can, and do, receive a high level of individual scrutiny. Monitoring and reporting responsibility was changed to a different team from July 2015. This change reduces the control assessment in the risk model to acceptable. This is a medium priority for assurance. Our external technical auditor will carry out a review of our methodology, data quality and final numbers. The audit will also include sampling of data from report back to source. This measure has financial incentives attached and so even though controls were found to be robust it remains a medium priority for assurance. Sewage treatment works discharge compliance This is a measure of the effectiveness of our Sewage Treatment Works to treat waste water to an appropriate standard before it is returned to the environment, as stipulated in Environment Agency consents. Previous audits found no material issues. The risk assessment found sampling, analysis and data recording covered by a rigorous quality system assured by UKAS. Reporting is performed directly from our Laboratory Information Management System and is also monitored monthly by our Management Team and Board. Reports are also subject to Environment Agency scrutiny. The risk assessment found good controls in place. This is a high priority for assurance, it is important that all data quality controls are working effectively. Continuing UKAS certification, which covers sampling, laboratory and data audits. Our external technical auditor will audit data extraction, interpretation and reporting. This is a complex measure with financial incentives attached and as such is a high priority for assurance. Bathing water compliance This is the number of designated bathing waters that meet the regulatory sufficient standard based on the results of the independent testing of seawater by the Environment Agency during the bathing water season. Sampling and monitoring is carried out independently by the Environment Agency. Previous audits have found no material issues. This remains a low priority for assurance despite now having financial incentives attached. This is a low priority for assurance. No additional assurance required. 18 Our Assurance Plan 2016/17

PERFORMANCE COMMITMENTS Leakage DESCRIPTION RISK BASED REVIEW PLANNED ASSURANCE ACTIVITIES The measure is based on the volume of water leaking from the company s water supply assets. The annual average is applied to give a figure for mega litres per day (Ml/d). It includes any uncontrolled losses between water treatment works and customers internal stop taps. It does not include customers internal plumbing losses. Previous audits found no material issues. The risk assessment found data held in multiple separate company corporate systems and manipulated in spreadsheets. These are technical and complex processes, however leakage is calculated using a recognised industry standard and follows a clearly documented methodology. The risk assessment found good controls in place. This is a high priority for assurance, it is important that all data quality controls are working effectively. Our external technical auditor will examine the application of reporting requirements, our methodology, data quality, the leakage calculation and final numbers. Other strengths noted Leakage was subject to a full system audit in 2014. This was a combined audit, carried out by Internal Audit and an external technical auditor. This audit found no material issues. This is a complex measure with financial incentives attached and as such is a high priority for assurance. Properties experiencing poor water pressure This measure is the number of properties regularly experiencing water pressure below the minimum standard. Previous audits found no material issues. The risk assessment found extensive validation controls in place with systems and processes fully documented and data quality controls fully evaluated and assessed. The risk assessment found good controls in place. This is a medium priority for assurance. Our internal audit team will conduct a system and data quality audit. The audit will also include sampling of data from report back to source during the year and reporting of final numbers. Other strengths noted This measure was subject to a full system audit in 2013. This was a combined audit, carried out by Internal Audit and an external technical auditor. This audit found no material issues. This measure has financial incentives attached and so even though controls were found to be robust it remains a medium priority for assurance. No material issues identified in previous audits. The risk assessment found there is regular internal data quality monitoring. Data from company operatives is captured and recorded directly into corporate systems. Data from contractors is captured on data sheets and input into company systems. Data is then reported directly out of corporate systems and is subject to senior manager scrutiny throughout the year. The risk assessment found good controls in place. Water mains bursts This is the number of water mains bursts and is determined by the number of completed repairs. The impact of bursts on our customers is measured via other performance commitments such as poor pressure, interruptions to supply and leakage. This is a medium priority for assurance. Our internal audit team will conduct a system and data quality audit. The audit will also include sampling of data from report back to source during the year and reporting of final numbers. 19 Our Assurance Plan 2016/17 This measure has financial incentives attached and so even though controls were found to be robust it remains a medium priority for assurance.

PERFORMANCE COMMITMENTS Greenhouse gas emissions DESCRIPTION RISK BASED REVIEW PLANNED ASSURANCE ACTIVITIES This is a measure of the greenhouse gases produced by our operations and assets. No material issues identified in previous audits. The risk assessment found extensive validation controls in place. The reported numbers are based in part on certain assumptions, however this only relates to a small proportion of the total reported number. This is a medium/low priority for assurance. Internal Audit will carry out a systems and final numbers audit, paying particular attention to documentation. Other strengths noted Our greenhouse gas data was subject to a full system audit in 2015. This was a combined audit, carried out by Internal Audit and an external technical auditor. This audit found no material issues, although in some cases documentation relating to roles and responsibilities could be improved. The numbers are produced using the latest version of the Carbon Accounting Workbook. This is an industry wide approach developed by the Water Research Council and endorsed by Ofwat. The risk assessment found good controls in place and the priority for assurance score is medium/low. Asset health determinations, water and wastewater A number of our performance commitments are aggregated to understand the effectiveness and sustainability of our long term stewardship of our assets. Our performance against the resulting Asset Health measures has a very significant impact on penalties and rewards. Previous audits (of serviceability and asset health) have found no material issues. The risk assessment found this is technical and complex area, however it is non-judgemental and based on a fixed methodology. The Management Team and Board monitor performance throughout the year. The risk assessment found good controls in place for water measures and acceptable controls in place for wastewater. This is a high priority for assurance, it is important that all data quality controls are working effectively. Our external technical auditor will examine our methodology, its application, and the outcome of the determination of asset health for water and wastewater. This is a complex measure and has a direct impact on significant financial incentives so is a high priority for assurance. 20 Our Assurance Plan 2016/17

PERFORMANCE COMMITMENTS Outcome delivery incentive calculation DESCRIPTION RISK BASED REVIEW PLANNED ASSURANCE ACTIVITIES Calculation of rewards or penalties for performance commitments which have financial incentives attached. The calculation is carried out using a pre-audited model with formal methodology and guidance. The risk assessment found good controls in place. This has a direct impact on any penalties and rewards so the priority for assurance is high. This is a high priority for assurance, it is important that all data quality controls are working effectively. Our internal audit team will audit the calculation inputs and outputs and controls over the model. Annual Environment Report The company is committed to publishing an independent annual review of its environmental performance undertaken by the Corporate Responsibility Groups (CRAGs). In future years this will be covered within the remit of the Water Forums. Our risk assessment found good controls in place. This is an external independent review of NWL environmental performance. Any environmental performance commitments referred to in the publication will be covered individually elsewhere in this plan. Ascertaining whether or not the report is published is a straightforward matter. This is a low priority for assurance. No additional assurance required. This is a low priority for assurance. Whitburn combined sewer overflow (CSO) project This project is needed to improve the way in which wastewater is discharged to the environment at Whitburn. Delivery of this commitment has a financial incentive attached which compensates customers if the project is not completed on time - by 31 December 2017. Our risk assessment found good controls in place. While this is a complex project, ascertaining whether it is delivered on time is a straightforward matter. This is a low priority for assurance. This is a low priority for assurance. No additional assurance required. Delivering a consolidated customer information & billing (CIB) system As part of our improvements to IT systems during 2015-2020, we plan to implement a new customer information and billing (CIB) system. Delivery of this commitment has financial incentives attached which encourage us to deliver this project efficiently, sharing any savings with customers. The incentive arrangement also compensates customers if the system is not implemented on time - by 31 March 2018. Our risk assessment found good controls in place. This is a complex and high profile project which is closely monitored and contains a great deal of assurance to ensure that excellent customer service is maintained during and after implementation. From a performance commitment perspective, however, ascertaining whether the new system is implemented on time and to budget is more straightforward and is supported by a documented definition of what constitutes implemented as set out in our 2014 Ofwat Final Determination. This is a high priority for assurance. Our programme team have compiled a detailed plan with regular reporting against key milestones. External assurance will be provided by Deloitte to provide regular checks on the suitability of the programme to proceed to the next stage. The priority for assurance is ensuring customer service and data quality are maintained during and after implementation. This is a high priority for assurance. 21 Our Assurance Plan 2016/17

NEW OBLIGATIONS Ready for Retail (Market reform) DESCRIPTION RISK BASED REVIEW PLANNED ASSURANCE ACTIVITIES From April 2017, non-household customers in England will be able to choose their supplier for water and wastewater services. A comprehensive programme is required to be in place in readiness of the market opening and several new obligations will be introduced. Most notably a level playing field where wholesale companies must provide the same level of service to all retail companies. : Until April 2017, the focus will be on confirming readiness for market opening and certainty to Market Operator Services Limited (MOSL) and Ofwat that we will be ready. Post April 2017, focus concentrates on: Legal separation. Level playing field. This is a complex area with high importance. It is therefore a high priority for assurance. It should however be noted that a high level of assurance is already in place and required to meet external assurance requirements. This is a high priority for assurance. Our internal audit team will review the programme. External consultant will provide assurance of overall programme plan and mitigation of risks. We will conduct formal milestone reporting to MOSL and Ofwat. Developer Services Based on existing obligations, companies are now requested to formally submit performance information in relation to Developer services. : The risk assessment identified complex reporting systems, with manual intervention. Performance information will be published in set of industry league tables by Water UK. This is a new reporting requirement involving a degree of complexity. It is therefore a high priority for assurance. This is a high priority for assurance. Our internal audit team will conduct an audit of systems and processes used to produce data. We will conduct a formal review of March 2016 results. Further review will occur throughout 2016/17. 22 Our Assurance Plan 2016/17

23 Our Assurance Plan 2016/17

Northumbrian Water Limited Northumbria House Abbey Road Pity Me Durham DH1 5FG Designed by NWG Marketing www.nwl.co.uk www.eswater.co.uk www.welivewater.co.uk 24 Our Assurance Plan 2016/17