Risks and risk management

Risks are a natural part of all business operations and must be managed effectively by the organisation. Humana’s risk management is aimed at preventing, mitigating or precluding risks from materialising or affecting operations in a negative way. A risk is defined as an uncertainty about an event occurring that could affect the company’s ability to achieve defined objectives.

The purpose of Humana’s risk management work can be summarised as follows:

• to create management and Board awareness about the company’s risks
• to create effective governance and control of the business so that the company can achieve its objectives
• to provide data and processes that support daily operations
• to ensure investors and other stakeholders have effective information about the company’s risk exposure

In its risk analysis, Humana has identified conceivable events, scenarios and activities that could have an impact on the company’s operations and its ability to achieve defined objectives. These risks have been evaluated and concentrated into a list of the most relevant risks. The risks are graded according to probability of occurrence and the level of impact should they occur. An increased probability of a risk occurring does not always need to be a negative factor. It can also be positive in some cases, such as when the company believes that a change sharpens requirements, thereby raising standards in the entire industry.

The risks are monitored by Humana’s Group management and in the Board’s work. As Humana conducts operations in Sweden, Finland, Norway and Denmark, the assessment is based on the situation in the local markets and is then compiled into a Group-wide risk description.

Humana has decided to classify the identified risks in four risk categories:

A Sector and market
B Operations
C Compliance, responsibility and sustainability
D Financial

Sector and market-related risks concern external factors, events and changes in Humana’s markets that could influence the conditions for achieving the company’s defined objectives. The company has limited scope to influence these types of risks, but they remain risks that Humana needs to address as a company. There are often two sides to every sector and market-related risk: a downside, i.e., a risk or threat, and an upside, i.e., an opportunity. The sector and market-related risks identified by Humana are set out below:

Increased sector regulation

The care sector is subject to an extensive regulatory apparatus in the form of laws and regulations at the national, regional and local levels. Legislation, rules and regulations, which vary in Humana’s countries of operation, cover areas such as availability of services, access to services, quality of services, staff qualifications and obligations, and confidentiality rules. The trend is towards an increase in regulations.

Political decisions aimed at restricting private welfare providers and other political risks

Several political parties in the Nordic region are questioning the privatisation of care and support services and advocating restrictions on the ability to run private care companies for profit. The business model could be adversely affected by the introduction of legislation that limits or prohibits profits or restricts the rate of privatisation or the services eligible for privatisation.

Changes in personal assistance conditions and in the reimbursement model and allowance level

Humana’s Personal Assistance business area (Sweden) receives an allowance from the authority, Försäkringskassan, and municipalities. The state reimbursement allowance is set annually through the budget proposal. There is a risk that the allowance will not compensate for cost increases. There is also a risk of recovery from Försäkringskassan.

Several issues related to the policy on defining assistance conditions and the allowance level are also under more general discussion. In 2019, the LSS inquiry presented its report and the report from the personal assistants inquiry came out in 2020. The inquiries have not yet resulted in any changes in the conditions for personal assistance.

New political decisions could affect Humana’s future profitability and also the company’s ability to recruit.

Changes in demand and pricing

Prices of publicly funded care services can be set by local, regional and national authorities. This means that the prices are not exclusively controlled by market forces such as supply and demand. The need for care services funded by government and local authorities is increasing in society. An increased need for care should bring more demand for private care services and, for many years, purchases from private care companies have increased in nominal amounts each year. There is also a risk of price pressure due to budgetary constraints, as municipalities’ tax revenue is not growing in line with their costs of dealing with the increasing needs. A decrease in demand for private care services or price pressure would have a negative impact on Humana’s revenue and profitability.

Risk management
Humana adds important values to society through our core business; at the individual level and by us contributing to sound public finances. Humana focuses on high quality and conducts systematic quality work. The quality is measured on a regular basis through our quality index, Humana Quality Index, HQI. Humana also focuses on a high degree of specialisation and individualised care in order to remain competitive. The company also works to be cost-effective, which brings the public sector in the Nordic region annual savings of SEK 1 billion. This is because we are more cost-effective than the public sector when it provides the same care.

Risk level
Probability – Medium
Impact – Medium

Operational risks are mainly related to internal factors and events that could adversely affect the company’s operating activities and brand. Humana’s reputation and good standing are key to maintaining the trust of the company’s customers, clients, contractors and employees. Negative publicity about private care providers or a serious incident within the Group’s operations could have a considerable adverse impact on the company’s business and earnings. The operational risks identified by Humana are set out below:

Risk of not being able to recruit qualified employees

Humana’s operations are highly labour-intensive and the company is dependent on its ability to attract, employ and retain qualified personnel at market conditions. Expertise requirements are often high but vary from business area to business area. In Personal Assistance, the formal expertise requirements are low, while some of the services offered in Individual & Family operations require a high level of expertise and specialisation. Humana’s quality is dependent on employees’ ability to make the right decisions and have the right attitude in their daily work. At the same time, welfare is facing increasing recruitment needs, as the number of individuals in need of care will increase in the coming years, while the retirement rate is high and the working age population is declining in relative terms. New staffing requirements in elderly care in Finland will increase competition for labour there.

Should Humana fail to attract the right personnel, this could affect the quality of the company’s services and its growth opportunities.

Dependence on permits and correct professional qualifications

Humana’s operations and growth are dependent on the company’s ability to secure and retain permits from social services and authorities to conduct care operations. The permits are normally linked to people with the right professional expertise and, if they leave the company, Humana will need to apply for new permits. Several of the permits for Humana’s operations are linked to specific properties and if these operations are moved, Humana will need to apply for new permits. In Sweden, applications are subject to an assessment, which also looks at ownership and management, and an administration fee is applied for each permit application made to the Health and Social Care Inspectorate (Inspektionen för vård och omsorg, IVO). Humana’s operations in Finland, Norway and Denmark are also subject to permit. Permit processing times by authorities are often long. This means a risk of start-up delays and an associated increase in costs.

Dependence on framework agreements

Humana's operations are often dependent on framework agreements. The assessment is that it has become more important to have framework agreements and that it will become even more important in the future. There is a risk that the structure of the framework agreements include conditions that can be challenging, such as low compensation levels, and agreements can be based on price conditions rather than quality aspects.

Humana’s framework agreements for operations under own management do not normally contain assumptions on volume by the municipality (although this is not always the case), which means that actual volumes under such framework agreements may be uncertain. The agreements are of limited duration and, if Humana cannot fulfil the requirements stipulated in them, the agreements may be terminated early. As Humana secures long-term leases for premises used in its operations, the company bears a financial risk of its operating revenue being lower than the personnel and rental costs associated with the operations.

Risk related to future expansion and growth

Humana is a growth company that intends to continue expanding its business, mainly through organic growth, but also, to some extent, acquisitions. Humana’s future growth is affected by the company’s ability and expertise in driving organic growth by attracting customers, attracting employees and successfully running organic growth projects by, e.g., securing access to suitable properties. In parallel, we also need to be able to adapt the operation if the needs and requirements of clients, customers and authorities change, which may involve adjustments to operations.

Scope for growth through selective acquisitions is affected by the company’s financial position and ability to identify suitable acquisition candidates and negotiate purchase prices and terms. Effective integration of acquisitions into existing operations is also of key importance. There are business risks, tax risks and financial risks associated with growing, acquiring and integrating companies.

External cyber threats

A cyber threat or cyber security threat is a malicious act aimed at damaging data, stealing data or disrupting digital life in general. Cyber threats include viruses, overload attacks, blackmail programs (malware that encrypts files or entire hard drives and then demands a ransom fee for decryption) and other types of cyber attacks. In recent years, the number of cyber attacks and threats to companies’ information systems has increased greatly.

Risk management
Humana’s risk management includes work on risk prevention, external monitoring, regular system updates, training of users and monitoring to ensure that suppliers follow agreed security levels. There is also continuous monitoring of logs, external interfaces and the threat scenario.

Risk level
Probability – Medium
Impact – High

IT system limitations and unauthorised access to sensitive personal data

Humana handles a large amount of data in the form of personal information, social and medical information journals and business-critical information. Breakdowns or disruptions in IT systems, including such caused by sabotage, computer viruses, operator error or software defects, could have a negative impact on the Group’s operations. There is a risk of operational restrictions in the case of IT and system failures.

Risk management
Humana works systematically to minimise the risk of disruptions by means of administrative, logical and physical work on IT security. This involves regular system development and monitoring, streamlining of systems and procedures with operating partners and skills development. Improved requirements management, project management, testing, administration planning. Logging and random checks are performed to control unauthorised access to sensitive personal data.

Risk level
Probability – Medium
Impact – High

Legal processes and investigations

Humana may be negatively affected by judicial rulings, settlements and costs associated with legal processes and investigations. There is a risk that Humana could be party to legal action arising from alleged malpractice or medication errors in its operations. In the event of incorrect processes or practice, Humana could be liable to pay damages or compensation.

Risk management
Humana has patient insurance and third-party liability insurance for clients and systematic quality assurance, regularly reviews procedures, processes and competence, and checks that it has the right expertise. There are also legal partners if needed.

Risk level
Probability – Low
Impact – Low

Infectious diseases, epidemics and pandemics

Infectious diseases happen in society. Common examples are influenza and gastroenteritis (gastric flu or Norovirus). These diseases can infect anyone, but the situation is most severe for people in risk groups: frail older people, people with functional impairments or people with multiple conditions. In Humana’s operations, there are customers and clients in risk groups. Infectious diseases may also mean that several employees become sick at the same time, which can lead to difficulties in staffing the operations. If there is an epidemic (more cases of an infectious disease than expected) or a pandemic (an extensive spread of contagious disease in multiple countries, like Covid-19), this increases the risk of individuals being affected and the risk of problems finding skilled labour. In the case of an epidemic/pandemic, there is also a risk of revenue and expenses being negatively affected, for example, as a result of lower occupancy and incurring costs for sick leave.

Risk management
Humana’s management system has guidelines and procedures for how operations will prevent and manage various infectious diseases. The company also has procedures to establish a crisis management structure when needed, in order to further minimise the spread of disease and its impact on individuals and the company.

In 2020 and the first half of 2021, Humana has managed the ongoing Covid-19 pandemic primarily through ongoing risk analysis and preventive measures to reduce the spread of the virus and by measures such as cohort care if infection is detected. A special crisis management structure has been established to support the work.

Risk level
Probability – High
Impact – Medium

Negative publicity as a result of operational incidents in the company or the sector

Humana’s reputation is crucial to good relationships with current and potential clients and customers, and local, regional and regulatory authorities. The reputation of the sector in general also has an impact on Humana. If an incident were to occur in Humana’s or another private care operator’s business, through negligence or deliberate action, this could result in negative publicity that would harm the sector, Humana or the company in question in the form of damage to the brand and lost clients, and therefore lost revenue.

Risk management
Humana focuses on high quality, constant improvement, skills development, training and core value work. Well-grounded internal communication plan and preparedness for crisis management. Humana always reports serious deviations on the company’s website and has a transparent and accessible media approach. The company also works actively through the Association of Private Care Providers (Vårdföretagarna) and its counterparts in other Nordic countries.

Risk level
Probability – Medium
Impact – Medium

Humana’s operations are subject to extensive regulatory requirements. The Company must comply with a comprehensive framework of ordinances and other regulations at the national level. In addition, Humana’s business is dependent on the Company’s ability to obtain and maintain several permits and to successfully attract certain professional categories in order to provide specialised care services. Humana is also covered by data protection laws such as the Data Protection Regulation (GDPR), the Swedish Patient Data Act and corresponding legislation in Finland, Norway and Denmark. These regulations require systematised and secure routines to be in place for handling and storing personal information. The compliance risks related to laws and regulations identified by Humana are set out below:

Violation of data protection laws

Humana’s operations are subject to extensive data protection laws, such as the General Data Protection Regulation (GDPR) and the Swedish Personal Data Act. Legislative requirements on the processing and protection of personal data place high demands on processes and security when handling, storing and disposing of personal data, and ensuring that registered individuals are properly informed about how the companies handle personal information. Violations of the GDPR can incur a very high penalty and cause reputational damage.

Risk management
Humana’s data security policy sets out the division of responsibilities and guidelines for employees’ use of IT and data. Constant work is in progress to improve Humana’s processes, procedures and regular controls. This involves, for example, training and systematic improvement of processes and procedures and investments in systems. The company also works actively with suppliers to ensure their compliance.

Risk level
Probability – Low
Impact – High

Quality deficiencies affecting customers/clients

There is a risk of staff not following Humana’s procedures, but instead developing their own approach to clients and customers, who do not then receive the treatment or intervention that has been determined. The risk can arise, for example, during high staff turnover, when it is difficult to recruit staff or when there is a lack of leadership.

Risk management
Humana conducts extensive systematic quality work through our Parus management system. This is followed up by the company’s quality management and the guidelines for the quality work can be found in Humana’s quality policy. Internal controls are conducted in all operations. All employees have an obligation to report deviations and irregularities, which are then systematically followed up and analysed by the relevant manager. Clients can make complaints, both openly and anonymously. There is a whistle-blower function on Humana’s website

Risk level
Probability – Medium
Impact – High

Occupational health and safety

Health and social care are the sectors with the highest number of reported work injuries and illnesses caused by threats and violence. Humana’s operations are covered by regulations on occupational health and safety. Deficiencies in complying with such regulations could lead to fines or penalties. The Covid-19 pandemic increases risks in the work environment and in terms of safety.

Risk management
Humana conducts systematic health and safety work, with action plans and controls through regular safety inspections. The work is based on Humana’s work environment policy. The company continuously makes risk assessments from a health and safety perspective and trains managers in health and safety issues, including those related to the current pandemic. To manage the pandemic, Humana has also established a special crisis management structure to support the operations.

Humana applies collective agreements in all operations in the four countries in which we operate.

Risk level
Probability – Medium
Impact – Medium

Human rights violations

Humana’s operations are governed by regulations on working conditions, occupational health and safety, and freedom of association in our countries of operation. Our commitment to human rights is emphasised in our Code of Conduct and our Supplier Code of Conduct, in which we express our support for, e.g., the Declaration of Human Rights and the UN Guiding Principles on Business and Human Rights. The Codes also provide guidance on identifying, preventing and mitigating risks related to human rights.

Risk management
To reduce the risk of human rights violations, Humana works continuously to ensure compliance with both national legislation and regulations and international human rights provisions. Diversity and respect for human rights are normal practice and outlined in the company’s policy for Diversity and inclusion. Humana conducts active internal core value work, with internal training, established procedures and a whistle-blower function. All operations in Humana’s four countries are regulated by collective agreements and the Group's Code of Conduct applies to all staff and operations. In our work with suppliers, we have introduced (from 2021) a Supplier Code of Conduct. Most of Humana’s suppliers and partners are in the Nordic region.

Risk level
Probability – Low
Impact – Low

Corruption and fraud

Humana’s extensive operations involve a large volume of customer and supplier contracts. Agreements are signed and business decisions are made at different levels in the organisation. Individual customer contracts, framework agreements or construction contracts are signed with the customers, who are often municipalities. Supplier tendering normally arises in strategic purchasing and new construction. There is a risk that employees act unethically in customer and supplier relationships by, for example, taking or giving bribes. There is also a risk that employees act fraudulently. Legal penalties may arise. Humana could suffer both financial and brand damage.

Risk management
Humana counters corruption, bribery and fraud through procedures and internal control and has, e.g., well-functioning authorisation rights with system support. A clear decision-making and certification system facilitates decentralised responsibility for tenders and customer and supplier contracts, and reduces the associated risk. The Code of Conduct for Humana employees and, since the start of 2021, a Supplier Code of Conduct underpin the anti-corruption work. Humana also has a whistleblower function.

Risk level
Probability – Low
Impact – Low

Environmental risk

Humana’s climate impact is mostly through transport by car along with the development and operation of care homes. This includes heating and electricity as well as purchases and handling of food, beverages, consumables and medicine. Vehicle use is necessary to carry out our services, particularly in the Individual & Family operation.

Risk management
Humana endeavours to reduce the environmental and climate impact of its operations. This is a strategic Group target. Humana’s environmental work is based on our environmental policy. Here, climate and resource efficiency are defined as guiding criteria. Our environmental efforts are based on the principles of precaution and substitution. Each of Humana’s units strives continuously to work resource-efficiently and to minimise environmental impact and lower costs. A climate-smart travel policy applies to all staff. All staff undergo the company’s digital sustainability training.

Risk level
Probability – Low
Impact – Low

In the course of its operations, the Group is exposed to various financial risks. The Group’s financial policy for financial risk management has been formulated by the Board and provides a framework of guidelines and rules in the form of a risk mandate and limits for financing activities. Responsibility for the Group’s financial transactions and risk management is dealt with by the CFO in consultation with the Board and CEO. The overall goal of the finance function is to provide cost-effective financing and minimise adverse effects of market risks on the Group’s earnings. The company’s aggregate risks and measures are managed by the audit committee, which reports to the Board for assessment and approval. 

The financial risks identified by Humana are set out below:

Liquidity and financing risk

Liquidity risk is the risk of the Group being unable to discharge its payment obligations. Financing risk is the risk of the Group encountering problems in meeting its obligations associated with the company’s financial liabilities.

Risk management
The company’s CFO manages liquidity and financing risk centrally for the Group. The Group’s financial policy sets frameworks and guidelines for risk mandates and limits in financing activities. To facilitate liquidity planning and control, the Group has credit facilities, such as bank overdraft facilities, and a cash pool. Humana also works actively on its liquidity through active working capital measures. Focusing on cash flow and making adjustments in the event of changed market conditions reduces the risk of being unable to discharge obligations under financing agreements.

Risk level
Probability – Low
Impact – Medium

Interest rate risk

Humana’s finance expenses are affected by market interest rates. Changes in interest rates could increase Humana's borrowing costs, which in turn could adversely affect the Group’s earnings and cash flow.

Risk management
Derivative instruments may be used to manage interest rate risk. A gradually lower debt level during the year has helped to reduce interest rate risk slightly.

Risk level
Probability – Low
Impact – Low

Credit risk

The Group’s credit risks and credit losses are largely associated with accounts receivables and Humana’s excess liquidity. The credit risk for accounts receivable is the risk of non-payment of outstanding accounts receivables and non-invoiced services performed for Humana’s clients. The credit risk for excess liquidity is the risk that the bank is unable to meet its obligations.

Risk management
Most of the Group’s accounts receivables are from state, municipal and county council entities, which are considered to have good creditworthiness. The risk of credit losses is considered low. Humana’s surplus liquidity is invested at low risk in deposit accounts and contracts are only entered into with banks that have high credit ratings.

Risk level
Probability – Low
Impact – Low

Currency risk

The Group operates in Sweden, Finland, Norway and Denmark and is therefore exposed to risks related to currency translation from EUR and NOK to SEK, and, to a lesser extent, DKK to SEK. Translation is at the average rate for the financial year (in the balance sheet to the rate of the balance day). Currency risk also arises through business transactions, reported assets and liabilities, and net investments in foreign operations.

Risk management
Humana’s foreign currency exposure is partly offset by borrowing in the local currency.

Risk level
Probability – Medium
Impact – Low