XML 109 R32.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Risk Management and Strategy
The secure collection, maintenance, processing and transmission of confidential and sensitive information, including personal data, is a critical element of our operations. We rely on encryption and authentication technology licensed from third parties in an effort to securely transmit certain confidential and sensitive information, including credit card numbers. Our information technology and other systems, and those of our third-party service providers, that collect, maintain, process and transmit customer, employee, service provider and business partner information are susceptible to increasing threats of continually evolving cybersecurity risks.
Third-party supply risk is managed by functional teams for the Group. Our third-party risk management process ensures that we evaluate relevant third-party cybersecurity controls through a cybersecurity questionnaire. Risks are identified and assessed, and we include security addendums to our contracts where applicable. We have worked to develop and further implement our supplier-risk framework to help us to manage our suppliers more holistically across the lifecycle. In addition, we have an external third-party threat intelligence service that monitors the dark web and other intelligence sources to provide real-time threat information to the Group and for selected critical suppliers. This information is a proactive position on cyber threats. The intelligence is acted upon and disseminated to the relevant functional teams for action and information.
We have an established cyber risk appetite, framework and policies to support risk-based decisions on where and how to allocate security resources. The management of cybersecurity related risks is integrated into our overall enterprise risk management process. Risks are regularly identified, assessed, monitored and reported on to ensure that we are able to allocate security resources appropriately. Risks get reported at divisional, executive and Board risk committees.
We are regularly audited by various internal and external bodies that validate compliance with regulatory requirements and industry standards. We perform periodical internal assessments of the design and operating effectiveness of our cybersecurity controls, including penetration testing. Dedicated cyber teams in each division and at the Group level perform assurance activities against the Flutter cyber risk and control framework. A dedicated, independent IT internal audit team performs several audits each year on a risk-based approach to key and changing cyber risks. Internal audit's audit plan frequently covers cyber domains such as: patch and vulnerability, cyber threat management, security incident management, access management, network security, data loss prevention and business continuity planning. Agreed improvements are tracked through to completion.
We have specialist security teams available 24/7 located in key locations to respond to security incidents should they occur. We maintain cyber insurance to further reduce the consequences of certain types of incidents, and we disclose material incidents to relevant regulatory bodies. We have third-party providers who provide real-time and proactive threat and intelligence and retainer services that assist in forensics and incident support alongside retained legal counsel services.
As cybersecurity threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] The management of cybersecurity related risks is integrated into our overall enterprise risk management process.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Role of the Board
Our Board is primarily comprised of US nationals. The Risk and Sustainability Committee of the Board, is responsible for the review and oversight of issues related to the key technology risks facing the Company, including, but not limited to, the Company’s programs, policies, practices and safeguards for information technology, data privacy and protection, cybersecurity and fraud, identification, assessment, monitoring, mitigation and the overall management of those risks, and the Company’s cyberattack incident response and recovery plan. The Risk and Sustainability Committee receives standing quarterly updates from the Global CISO and CIO on, among other things, our divisional and Group-wide cyber risks, divisional progress on cyber initiatives, external insights, incident updates and post incident reviews, our cyber strategy and our views of the emerging threat landscape.
In addition, the Board receives regular updates via the Chair of the Risk and Sustainability Committee and various management committees, including the ORCC, Group internal audit, Group Risk and Group internal controls, and annual updates from the Global CISO and CIO on the state of cybersecurity across the Group. The Board is also notified of any relevant issues or incidents which have occurred or are reasonably likely to occur.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Board is primarily comprised of US nationals. The Risk and Sustainability Committee of the Board, is responsible for the review and oversight of issues related to the key technology risks facing the Company, including, but not limited to, the Company’s programs, policies, practices and safeguards for information technology, data privacy and protection, cybersecurity and fraud, identification, assessment, monitoring, mitigation and the overall management of those risks, and the Company’s cyberattack incident response and recovery plan. The Risk and Sustainability Committee receives standing quarterly updates from the Global CISO and CIO on, among other things, our divisional and Group-wide cyber risks, divisional progress on cyber initiatives, external insights, incident updates and post incident reviews, our cyber strategy and our views of the emerging threat landscape.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Risk and Sustainability Committee receives standing quarterly updates from the Global CISO and CIO on, among other things, our divisional and Group-wide cyber risks, divisional progress on cyber initiatives, external insights, incident updates and post incident reviews, our cyber strategy and our views of the emerging threat landscape.
In addition, the Board receives regular updates via the Chair of the Risk and Sustainability Committee and various management committees, including the ORCC, Group internal audit, Group Risk and Group internal controls, and annual updates from the Global CISO and CIO on the state of cybersecurity across the Group. The Board is also notified of any relevant issues or incidents which have occurred or are reasonably likely to occur.
Cybersecurity Risk Role of Management [Text Block]
Role of Management
The Group Chief Information Security Officer (“Global CISO”) is responsible for the Group’s cyber strategy and policies and supporting risk, assurance and reporting processes. Our Global CISO has over 20 years of extensive experience in cyber security domains and in senior leadership roles in the financial, media and government sectors. In addition, there are divisional directors of information security who are supported by over 250 cybersecurity specialists employed across Flutter to support the implementation of our cyber strategy.
We have established an Operational Risk and Compliance Committee (“ORCC”), which includes our Chief Financial Officer, Chief Legal Officer, Chief Operating Officer, Chief Information Officer (“CIO”), and Group directors across all functional teams. This committee, which meets monthly, oversees how risk and compliance standards are operationalized and enforced throughout the Group, including the implementation of risk mitigation activities where required. Areas that the ORCC covers, among others, include the Group’s cybersecurity risk and control environment and the enterprise risks and control environment of technology and legal risks.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
The Group Chief Information Security Officer (“Global CISO”) is responsible for the Group’s cyber strategy and policies and supporting risk, assurance and reporting processes. Our Global CISO has over 20 years of extensive experience in cyber security domains and in senior leadership roles in the financial, media and government sectors. In addition, there are divisional directors of information security who are supported by over 250 cybersecurity specialists employed across Flutter to support the implementation of our cyber strategy.
We have established an Operational Risk and Compliance Committee (“ORCC”), which includes our Chief Financial Officer, Chief Legal Officer, Chief Operating Officer, Chief Information Officer (“CIO”), and Group directors across all functional teams. This committee, which meets monthly, oversees how risk and compliance standards are operationalized and enforced throughout the Group, including the implementation of risk mitigation activities where required. Areas that the ORCC covers, among others, include the Group’s cybersecurity risk and control environment and the enterprise risks and control environment of technology and legal risks.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our Global CISO has over 20 years of extensive experience in cyber security domains and in senior leadership roles in the financial, media and government sectors. In addition, there are divisional directors of information security who are supported by over 250 cybersecurity specialists employed across Flutter to support the implementation of our cyber strategy.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Risk and Sustainability Committee receives standing quarterly updates from the Global CISO and CIO on, among other things, our divisional and Group-wide cyber risks, divisional progress on cyber initiatives, external insights, incident updates and post incident reviews, our cyber strategy and our views of the emerging threat landscape.
In addition, the Board receives regular updates via the Chair of the Risk and Sustainability Committee and various management committees, including the ORCC, Group internal audit, Group Risk and Group internal controls, and annual updates from the Global CISO and CIO on the state of cybersecurity across the Group. The Board is also notified of any relevant issues or incidents which have occurred or are reasonably likely to occur.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true