Cyber security and data protection Risks and uncertainties Being alert to the increased threat of cyber attacks remains a key focus. Protecting our clients’ data and being clear about how we use it is a more vital part of providing a modern digital service than ever. Mitigation and management We have continued to provide regular updates and guidance to volunteers and staff about cyber security and GDPR compliance throughout the extended period of homeworking in 2020/21, which has included mandatory training. We have continued to strengthen our controls in relation to privacy and cyber security, rolling out a mobile device management solution across the national charity. Looking ahead, we are enhancing our capability and bringing in more expertise, starting with the hiring of a Head of Cyber Security. Our privacy risk management board continues to monitor and learn from data security incidents with support and oversight from the audit and risk committee. Digital, data and technology Risks and uncertainties 2020 brought additional urgency to the need for digital transformation of our services to support remote service delivery and remote working. This brings with it the challenge of funding sustained investment. Mitigation and management We made additional investments in digital technology this year to further our progress in replacing our legacy systems with a more flexible architecture. We have also brought all of our products and platforms under a single Head of Product and set out a clear product strategy to support the organisation’s future ambitions. We are working to better align our funding model with our delivery model to ensure that we can sustain long-term investment in platforms to underpin our frontline remote advice delivery. Pension liability Risks and uncertainties The national charity is the principal employer in a defined benefit pension scheme. The deficit in the scheme is significant with the ongoing risk that it will increase. Mitigation and management The March 2019 triennial valuation showed the scheme had an increased actuarial deficit of £68.5m. Therefore, to reduce the risk for the scheme Citizens Advice agreed to increase future annual deficit contributions to £2.11m per year (from £1.611m per year) and extend the payment period to 31 March 2037 (from 31 December 2033). In addition, during the year Citizens Advice made a one-off contribution of £1.5m. The scheme has a professional pension chair, a board of trustees and professional advisors to help mitigate any risks the scheme has. For example, during the year the Pension Board made some changes to asset allocations to increase the level of protection against interest rate and inflation risk. 54 Risk and internal controls