Compensation and Market Trends

Mid-Year Report 2016Security

BARCLAY SIMPSONCOMPENSATION AND MARKET TRENDS REPORT

2016SECURITY

CONTENTS

Welcome to Barclay Simpson’s 2016 Security Compensation Market Trends ReportBarclay Simpson has been producing corporate governance market reports since 1990. As usual this year we are producing two security reports. We use our Mid-Year Report to update our Annual Report and as an opportunity to focus primarily on compensation. This report seeks to provide insight and guidance into compensation within security. It is supported by a comprehensive survey of security practitioners registered with Barclay Simpson in June 2016. Clearly the approximately 500 respondents are not entirely representative, as they are security practitioners who have registered with a recruitment consultancy and who have taken the time to complete the survey. There are, no doubt, many security practitioners who go through their entire career without doing either. Nonetheless, the results make interesting reading and comparisons with previous years provide useful insights into the changing shifts within security. Comparable reports exist for all other areas of corporate governance. They can be accessed in section 6 of this report (“About Barclay Simpson”) or at www.barclaysimpson.com.

We place great value on the professional reaction to our reports and would appreciate your comments and any further requests for clarification or information.

1 ExECUTIvE SUMMARY p 12 MARKET ANALYSIS p 23 MARKET COMMENTARY p 34 SECTOR ANALYSIS p 45 SALARY GUIDE AND COMPENSATION SURvEY p 6 5i KEY CONCLUSIONS p 7 5ii OvERvIEW p 85iii GENERAL RESULTS p 125iv SALARY GUIDE p 24

6 ABOUT BARCLAY SIMPSON p 27

OfficesLondonNew YorkDubaiHong KongSingapore

DisciplinesInternal AuditRiskComplianceSecurity LegalTreasury

Living with Brexit uncertainty

We wrote at the start of the year that the security recruitment market does not operate in a vacuum. It remains substantially dependent both on the economic environment within which it operates and also the perceived threats and losses that can result from a lack of investment in security. Like many others in the recruitment industry we were anticipating that any demand suppressed by the uncertainty of Brexit, would result in an uptick in demand as the vote was settled in favour of the status quo. Clearly this did not come to pass and the result has only increased the level of uncertainty. For both clients potentially looking to recruit and candidates looking to change job, the result increases the value option, at least in the immediate aftermath, of doing nothing.

Recruitment decisions are still neededHowever, our expectation, provided a serious economic reversal can be avoided, is that what is a fundamentally strong security recruitment market will live with the uncertainty caused by Brexit. Even in periods of uncertainty recruitment decisions ultimately need to be taken and for many companies those that relate to the investment in security have a more limited capacity for deferral than others. The consequences of Brexit will no doubt have become clearer by the time we produce our next Annual Report at the start of 2017. In the meantime,

this report will focus on compensation and the results of our annual survey. Our survey was conducted before Brexit and it is possible that some of the sentiments expressed in it may have subsequently changed. The compensation data will not.

A buoyant recruitment marketAt the start of 2016 real earnings and overall employment numbers in the economy were still growing strongly. Whilst there has been a reported slowdown in the wider economy and other areas of corporate governance in the first half of 2016, these developments were not reflected in our security survey results which were generally positive.

The survey found that the percentage of security practitioners reporting to have changed job increased from 25% in our 2015 survey, to a robust 31% in 2016. The increase in average base salary for those staying with their employer rose from 4.9% to 5.6%. In a low inflation environment this is a good result and one acknowledged in our survey, as more security practitioners reported they felt adequately compensated. It indicates the value companies place on retaining high quality security practitioners.

It’s not all good newsHowever, there was a rise in the number of security practitioners reporting they were unemployed, with 72% of those not working finding it more difficult to find a new job than anticipated. This is consistent with our Annual Report comments that companies are constantly looking to upskill and the need for security

practitioners to grow with these increased demands. Also, whilst salary data was strong, benefits such as bonuses and pensions were marginally down.

How security practitioners feel?In this year’s survey we have included some questions about how security practitioners feel. Whilst there was a strong sentiment that their skills are becoming more valuable, which is certainly reflected in the general increase in salaries, there is not a universal belief that their employment is becoming more secure; something Brexit will have done little to enhance.

ExECUTIvE SUMMARY1

1

Even in periods of uncertainty recruitment decisions ultimately need to be taken and for many companies those that relate to the investment in security have a more limited capacity for deferral than others.

““

MARKET ANALYSIS2

VacanciesRate of vacancy generation remains stable The increase in the number of vacancies reported at the start of the year has followed through into 2016. Whilst the expected increase in demand from the banking sector did not materialise, the wider financial services sector encompassing insurance, asset and wealth management has been strong.

Demand across all sectors is high for mid-level practitioners such as experienced consultants and junior managers. This is a direct result of the demands being made on departments. Without necessarily having the budgets to transform the security profile of companies, CISOs are seeking ‘doers’ who can quickly and effectively deliver what is required. As many companies look to bring these skills in-house, demand for practitioners with security operations skills will continue. Whilst Brexit has the potential to undermine confidence, the scale of the cyber security threat and risks of data leakage will help limit any budgetary constraints.

Vacancy generation in corporate security has slowed in both the banking and the energy sector. However, within financial services the insurance sector is bucking the trend and vacancy generation across other sectors, including FMCG, pharmaceutical, technology and logistics at both senior and mid-levels, remains broadly stable.

Rate of placementsRate of placements holdingTo provide a better insight into the dynamics of the security market, this graph plots the rate at which placements have been made across the last four years. The graph demonstrates the rate at which candidates are being offered and accepting jobs. We reported at the start of 2016 that the rate of placements was mirroring the increase in the number of vacancies and that, outside of banking, companies were filling vacancies in information and cyber security quickly. This urgency has broadly continued. In a limited number of instances departments are moving quickly in fear they could potentially lose the headcount. There are two other factors. Firstly, companies are taking a more flexible approach to the salaries they are prepared to offer, and secondly in a market where the skills companies seek can be difficult to secure, employers are being more flexible in their requirements. Given the increase in the number of unemployed practitioners there is a limit to this flexibility as the standards expected from security practitioners continue to rise. The urgency reported in information and cyber security is not necessarily replicated in corporate security. Given what is usually a pool of strong candidates to select from, companies are taking the time and opportunity to make offers only to those candidates considered entirely suitable.

2

- Placement rate

- New vacancies- Outstanding vacancies

3

MARKET COMMENTARY3

Pressure on salaries continuesPrior to the Brexit vote earnings in the wider economy were increasing at the fastest rate for some years. These rises have been reflected in the security recruitment market. Relentless headline grabbing data leakage events such as the ‘Panama Papers’ and emerging cyber threats, such as APT are ensuring information and cyber security retains its high profile and the attention of corporate leaders and governments. Chronic shortages of practitioners with the skills required puts pressure on salaries and this has been reflected in our survey.

Given these increases it is not surprising that a higher percentage of security practitioners are reporting satisfaction with their remuneration, up from 56% in 2015, to 58% in 2016. Whilst salary remains a key issue, in this year’s survey, for the first time we invited security practitioners to report on what they would most like to change about their job. 31% reported salary, another 25% career development and 19% work life balance. Clearly salary is not everything.

Women and security Women are under-represented in information and cyber security as they are in the wider IT industry. However, there are an increasing number of companies looking to change this with some insisting that shortlists include female candidates to select from. Whilst this can cause difficulties given the under-representation of women, this more welcoming stance might potentially be contributing to the slow but steady rise in the number of female practitioners in our survey, up from 4% in 2014, to 9% in 2015 and 11% in 2016. Given 9% of women

have worked in security for less than 2 years, compared to only 3% of men, it should result in the proportion of women in security continuing to rise.

Cost pressures regionsThe cost of information and cyber security is increasing in response to more sophisticated and determined attacks. Whilst much is made of the London-centric nature of the UK economy, pressure on desk space in London and lower costs in the regions makes it practical to employ security practitioners outside of London. Moves by banks, other financial services companies, utilities and telecom groups are resulting in buoyant regional markets, with some regions such as the North West and Mid Lothian reporting that in some instances salaries are starting to approach those in London and the South East.

Moves top and bottom An intriguing more recent development has been the number of almost ‘political’ appointments into senior security leadership roles. Given this, some might feel their chances of promotion are diminished without a successful civil or security service career. Time may tell if those with government sector backgrounds can deliver the required performance or if seasoned commercially experienced CISOs are more effective in these positions. At more junior levels the movement of security practitioners between sectors remains more fluid than in other areas of corporate governance and it is increasingly becoming the norm for security practitioners to move into related departments. For example, cyber risk offers a route into operational risk and internal audit departments are now regularly seeking information or cyber security skills.

No simple message In another feature of this year’s survey, we gave practitioners the opportunity to share what they might like to say to their employer. If we were hoping for a simple message, it was not forthcoming. There were however some clear messages the most prevalent of which was the need to be valued. This was not just about salary, but about recognition, with many feeling under pressure to deliver in a resource limited environment. More investment and the need for management to listen was important: training, career development and a desire for more flexible working were all there. There was not however a hotbed of resentment and many were grateful to their employers and were satisfied with their employment relationship. Given many CISOs are limited on what they can spend in terms of any strategy to retain their security practitioners, career development, recognition and flexible working would be worth keeping in mind. In spite of this, there are clearly many occasions when security practitioners simply outgrow a department and, for career development reasons need to move.

Mixed sentiments?Two new questions in this year’s survey asked security practitioners if they felt more or less secure than a year ago, and secondly if they perceived their skills to have become more or less valuable. Surprisingly 30% of respondents felt they had become less secure while 67% believed their skills had become more valuable, with only 11% reporting less so. It seems a little at odds that whilst a clear majority of security practitioners believe their skills are becoming more valuable, a significant number felt less secure, something that Brexit will have done little to improve.

SECTOR ANALYSIS4

FINANCIAL SERVICES

In our Annual Report at the start of the year we wrote about the changes in the financial services industry as companies looked to implement the three lines of defence corporate governance model promoted by the regulator. Within the larger banks many of the necessary reorganisations have either been implemented or are close to completion. The sectors that are currently moving vacancies through to completion most effectively are insurance and funds. Both sectors are under regulatory scrutiny and as such priorities are clear with smaller companies in particular having to invest in information and cyber security.

In most demand are mid-level, well rounded Information Security Officers with technical credibility. Currently effective generalists are more valuable than more narrowly focused specialists. Given this, practitioners lacking technical understanding – for example those previously focused on policy creation or for example best practice, will currently find it harder to secure financial sector roles. However, for those with the right skills, many companies in the sector are demonstrating flexibility in the salaries they are prepared to offer.

The trend to bring operational security in-house is continuing with more areas being brought under the control of the internal departments. Penetration testing, “Red Teams” are currently being grown in many financial services groups.

Recruitment from the usually dominant banking sector has slowed. Recruitment freezes are not uncommon amongst Tier 1 banks who are more likely to be affected by the uncertainties surrounding Brexit.

COmmERCE AND INDuSTRy

Within commerce, the slow-down in the energy sector continues with limited vacancies and it remains the only sector where redundancies in cyber and information security have been prevalent. Whilst mergers within the telecoms sector have slowed demand, other sectors are either still growing their security functions or are establishing new functions, with demand remaining broadly robust. Another positive is that the size of companies looking to recruit their first information or cyber security specialist continues to fall.

All-round skills are valuedAs in the financial services sector, a candidate’s value is often dictated by their all-round skills rather than a more narrowly defined specialism. Those with strong technical skills are often put into previously non-technical roles. If they have the corresponding appreciation of processes and risk management they can drive performance from their technical, stakeholder peers and suppliers.

Whilst the financial services sector has been responding to shortages of candidates with a greater degree of flexibility on salaries, companies operating in the commercial sector are less likely to be flexible and more likely to keep within pre-existing budgets. On many occasions where candidates have expected offers to be increased, they have been disappointed. This is supported by our salary survey where increases achieved by practitioners changing jobs have been 20% in financial services, but only 14% in commerce.

4

For those with the right skills, many companies in the sector are demonstrating flexibility in the salaries they are prepared to offer.

““

CONSuLTANCIES AND SySTEmS INTEGRATORS

We reported at the start of the year that demand from this sector was continuing to rise with many larger groups undertaking continuous recruitment programmes. However, there was evidence of a slowdown in the sector in the run up to the Brexit vote with a number of consultancies having consultants ‘on the bench’. The vote to leave will not have improved confidence. In spite of this, consultancies are still recruiting although not in quite the same volume.

A tough marketThe skills and experience they require are also becoming more focused and specific. It remains a tough market to recruit for, with competition from in-house departments and other consultancies. In our survey we ask security practitioners what they would most like to change about their job. Within the consultancy and SI sector salary was by far the most popular choice. Given this and that consultancies are working hard to retain consultants, salary increases available to those who have stayed with their employer are higher than in any other sector.

A more recent development in the sector is that consultancies focused on aerospace and defence sector cyber work are using their success to break into other areas of commerce and, more notably, the financial services sector. Their experience in the defence sector is proving marketable given the widening threat landscape.

The consultancy and SI sector has grown rapidly recently. Given the uncertainties resulting from the Brexit vote, we anticipate that growth will become more measured.

ThE CONTRACT mARkET

Contracting is an integral part of the security recruitment market and, more than any other areas of corporate governance, it has continued to gain in popularity. A new development however is the change in the taxation of dividends. Higher tax does have the potential to influence security practitioners in their choice between permanent or contract work. According to our survey information security practitioners are feeling more secure and satisfied than in other areas of corporate governance. Contract rates also remained broadly stable in the first half of 2016. However that does mean there are not concerns. The percentage of contractors who believe the market for their skills is increasing fell from 70% in 2015, to 58%, with 14% believing the market for their skills is deteriorating. As ever, according to our survey, contract rates are the most important consideration when they are considering a new contract.

Cloud migration remains a key growth area and was responsible for a significant proportion of the new contracts that became available in the first six months of 2016. We expect this to continue with growing numbers of companies utilising the benefits of the Cloud. The IoT (Internet of Things) is another growth area, although, it will become more prevalent in some industry sectors than others.

In roles that require fewer technical skills and are more compliance, governance and assurance focused there has been a greater emphasis on recruiting contractors with Data Protection experience. This is primarily due to the EU General Data Protection Regulation which may have an uncertain future given the Brexit vote.

5

There was evidence of a slowdown in the sector in the run up to the Brexit vote with a number of consultancies having consultants ‘on the bench’. The vote to leave will not have improved confidence.

““

6

Our mid-year Report provides an in depth section on salaries and compensation, designed to provide a much fuller picture of overall remuneration.

Most security practitioners are keen to know their market worth. This is not always easy to address. Two otherwise similar security practitioners may enter the recruitment market and accept materially different salaries. We provide this caveat because we are aware that the security recruitment market is sufficiently diverse that it defies simple categorisation. However, security practitioners and their employers want guidance and this is what we attempt to provide.

As recruitment consultants we are involved in the negotiations that take place between employers and prospective employees. We are aware that whilst salary is usually the most important consideration, a number of other factors combine to make up total remuneration. In addition to the data we gather from the placements we make and the recruitment work we do, including contact with security and human resources departments about salaries and other benefits, we have also conducted a Compensation Survey to provide specific detail on all different types of remuneration within security.

The Survey was of security practitioners registered with Barclay Simpson and was conducted in June 2016. It generated several hundred responses.

Covers both permanent and contract marketsIn addition, we also conducted an Interim Compensation Survey covering the contract market. We have incorporated the key findings into this report to make it as easy as possible to understand the full picture for security.

We hope that you find the results interesting. This report provides the key highlights of the Survey. If you would like more detail about your specific sector or role, please call Adrian Simpson on 020 7936 2601 (as@barclaysimpson.com).

This section is broken down into 4 parts:

1. key Conclusions – Key conclusions from the Security Compensation Survey

2. Overview – Commentary on the major trends in salaries and other benefits paid to security practitioners

3. Compensation Survey – Results of Compensation Survey completed by security practitioners

4. Salary Guide – Guide to salaries for specific security roles and positions

Security2016 SALARY GUIDE AND COMPENSATION SURvEY

5

7

Recruitment activity upp 31% of security practitioners have changed job in the last 12

months, up from 25% in 2015

p 43% of women have changed job in the last 12 months

p At 47% of respondents, career development remains the most important motivation for changing job

Proportion of women now 11%p Although still low compared to other areas of corporate

governance, having jumped in 2015 from 4% to 9%, the proportion of women working in security increased again in 2016, to 11%

Salaries mixedp Average salary increase for non-movers up from 4.9%

to 5.6%

p Average salary increase for job movers down from 17% to 16%

Marginal fall in other benefits p Marginal drop in number of companies paying bonuses

(down from 75% in 2015 to 74%) and average level of bonuses (down from 22% of base salary to 20%)

p Additional pension benefits (received by 71%) are worth 9.5% of base salary (down from 9.9% in 2015)

p As in other areas of corporate governance, the average value of other benefits has dropped, but at £4,600 remains substantial

Increase in satisfaction with remunerationp Despite the drop in other benefits, the level of satisfaction

with the current level of remuneration is up from 56% in 2015 to 58%

value of skills increasing, but decline in job securityp At 67% there is a strong consensus that the value

of skills is increasing with just 11% feeling their value is decreasing

p However, 30% feel less secure than a year ago, compared to 23% who feel more secure

Difficulty increasing for those out of work p The number of security practitioners out of work has

risen from 3% to 5%

p 72% are finding it more difficult to find a new job than they anticipated, up from 47% in 2015

p Rise in the average time that out of work security practitioners have been looking for work

p In 2015, no ‘out of work’ security practitioner reported looking for over 6 months - this has jumped to 25% in 2016

Work / life balance is importantp 19% of security practitioners cite work / life balance

as the thing they would most like to change about their job

p Flexible working still high at 79%, though slightly down on 83% in 2015

p 70% of respondents desire more flexible working

Broad satisfaction from contractorsp 83% of contractors are satisfied with their current

contract, down from 87% in 2015

p 84% believe they are adequately compensated, up from 79% in 2015

The results of the Barclay Simpson 2016 Security Compensation Survey reveals security practitioners are becoming more satisfied with their compensation. However, their attitudes and rewards between different sectors, regions, genders and other classifications are many and various. We hope you find the results interesting.

5ikey Conclusions

8

5iiOverview

Motivation for potentially entering the recruitment marketWe asked this question for the first time this year. It is useful to compare the reasons security practitioners gave for moving roles, with the primary motive of those who might consider a move.

Q - If you were to look for another job or go for an interview, what would be the most likely reason?

Salary jumped to the most likely reason and given this we suspect that salary is a bigger motivation than security practitioners “post move” are prepared to admit.

It is also notable that job security remains low and only 1% higher than those who have moved and no higher in the public sector than others. Interestingly career development remains by far the biggest motivating factor for women.

Salary increases achieved without changing employerAccording to our survey, the average increase for security practitioners who stayed with their existing employer increased from 4.9% in 2015 to 5.6% in 2016 which, given the low inflationary environment, represents a significant increase in real earnings. Whilst the headline rate is perhaps unsurprising, averages can be misleading. For example, many of the people who stayed with their employer will have benefited from promotions or even buy-backs.

Motivation for entering the recruitment market This analysis looks at what motivated security practitioners to change employer in the last 12 months. A particularly high 31% of security practitioners changed job in the last 12 months and career development was, as ever, the most common driver with 47% citing it. Work / life balance and salary were as ever significant although salary fell from 26% to only 21% of respondents. It is gratifying that the percentage citing job security fell to only 6% although in the public sector the figure was 17%.

An interesting development is the high percentage of women citing career development as the principal reason for changing job and the relatively high percentage of men citing better work / life balance. Historically the reverse has been true. Non-managers are more focused on career development, whereas managers are more focused on a better work / life balance. Career development was notably high for security practitioners working in both the public sector and consultancy.

Q - What was your primary motivation for looking for another job?

Whilst salary is clearly not the primary motive for security practitioners seeking another job, most will expect to better their salary. In contrast to other areas of corporate governance, only 64% of security practitioners were satisfied with their salary having changed job, against 55% of those who had not. We would usually expect a bigger disparity between these two percentages.

9

What is surprising, given the buoyant economy, is the 25% of security practitioners who did not receive a salary increase, this is an increase from 20% in 2015 and not what might be expected in a supposedly ‘hot’ recruitment area in a growing economy. The percentage of people reporting to have received no salary increase varies and is consistently higher than might be expected across all areas of corporate governance. The answer does not lie in the public sector. The answer may well lie in those employers who recognise that where security practitioners do not have marketable skill sets, they do not have to offer salary increases to retain them. We can only speculate what that might do for a security practitioner’s motivation.

The average salary increase for women was 6.4%, against only 5.5% for men, the difference is perhaps a reflection of the drive by a number of companies to recruit and promote women. Average salary increases again were higher in consultancy than in other sectors which is indicative of the competition consultancies face in retaining their consultants. Their response is often to raise salaries.

Q - Which option best describes your salary increase in the last year?

More security practitioners have benefited from salary increases in excess of 10%, a figure usually associated with either a promotion or buy-back, both of which have become a more regular feature of the security recruitment market once a resignation has been submitted.

Salary increases achieved by changing employer The survey indicates that the average salary increase achieved by security practitioners marginally fell in 2016.

There is a significant difference between the 16.2% increase in salary achieved by changing job and the 5.6% average achieved by staying with an existing employer. However, analysing the average, as we did last year, reveals a wide range of outcomes. It is particularly instructive that whilst 16.2% may be taken as the average, only 15% of security practitioners accepted a salary increase between 10% and 20%. In fact, whatever the resulting salary increase, the results of our survey indicates it is unlikely to be the average of 16.2%.

Q - What best describes how your current salary compares with your previous salary

It might seem curious that 22% of security practitioners would move for the same, a similar percentage to 2015 and actually significantly down from 28% in 2014. However there are many reasons why this may happen: a job could be under threat or made redundant, it may be the result of relocation, for example a move away from London, an international move or perhaps the opportunity to work in a new sector or specialist area. Others are prepared to accept a better work / life balance and yet there are those who are not seeking a bigger job but simply, in their terms, a better job – one that perhaps avoids the responsibility and stress that some security practitioners comment on. Equally, whilst base salary is the most compelling element of any offer, there are other benefits, such as pensions, bonuses and holiday entitlement to be considered.

June 2012

June 2013

June2014

June2015

June 2016

11.5% 14.1% 16.8% 17.1% 16.2%

10

23% of security professionals achieved salary increases in excess of 30%, which will include those moving from low to high cost locations such as London. There is clearly a need for security practitioners with in demand skill sets and particularly for those who combine them with commercial savvy and effective communication skills; and on some occasions companies are prepared to pay significant salary increases to acquire them.

Salary v Remuneration Whilst base salaries always catch the headlines, offers of employment invariably include other benefits. On average, these additional benefits make up over 30% of total remuneration. We will use this opportunity to provide an overview of the other benefits that security practitioners might expect to receive.

BonusesThe percentage of employers paying bonuses fell marginally from 75% of employers in 2015 to 74% of employers in 2016. Bonuses perhaps not surprisingly are least common in the public sector. Larger employers are far more likely to pay a bonus than smaller employers, and managers are more likely to receive them than non-managers. 31% reported receiving a higher bonus with only 16% reporting a lower bonus in 2016; an identical result to last year.

Bonus payments fell back slightly from 22% in 2015 to 20% in 2016, although they remain higher in security than say a comparable area of corporate governance such as internal audit.

The average bonus however is not the typical bonus. 42% of security practitioners reported they received a bonus of less than 10% whilst only 29% received a bonus of over 20%. The most common bonus received by 19% of security practitioners was between 5-10%. Bonuses are higher in larger employers and the average percentage paid to managers was 23% against 11% for non-managers. The average bonus paid was again higher from companies in industry and commerce than in financial services.

Bonuses are often non-contractual, often discretionary and may be paid on the basis of corporate or personal performance or a combination of the two. There can also often be a qualifying period.

An issue with bonuses is that whilst a security practitioner entering the recruitment market who has benefited from a bonus may add it to their base salary, they are more inclined to discount bonuses when discussing expected salary. This goes some way to explaining what can otherwise be relatively high increases in the base salaries achieved by security practitioners moving between employers.

Pensions Given that work-place pensions have now become mandatory, there is really little point in asking security practitioners if they are entitled to an employer pension contribution. In 2016 we have therefore asked if their employer paid above the statutory minimum. 71% reported they did with managers and those working for larger companies most likely to benefit. At 81%, public sector workers are most likely to benefit from pensions above the statutory minimum whereas at 63% this is least likely in consultancy. The average pension contribution made by employers fell marginally from 9.9% in 2015 to 9.5% in 2016. Larger employers are generally more willing to pay higher contributions, with the public sector leading the pack at 11.4% followed by banking and financial services at 10.1%. The typical employer contribution, enjoyed by 51% of respondents to our survey, is between 5-10%.

For new recruits, final salary pensions no longer exist in the private sector. Those who still benefit from these appreciate they are valuable and the cost of giving them up to join a new employer can be prohibitively expensive. Pension schemes in the private sector are invariably money purchase where the employer commits to making a contribution based on a percentage of salary.

Whilst there can be a short qualifying period before contributions commence, work-place pension legislation requires all companies to enrol an employee in a pension scheme within three months of employment commencing. For those who elect to stay enrolled, minimum employer and employee pension contributions based on an employee’s salary are now mandatory. Most companies pay above these minimums based on a fixed percentage of an employee’s base salary. The employee may or may not be required then to match it. Frequently employers will be prepared to match additional contributions made by the employee up to a fixed percentage. The percentage may increase both with the age of the employee, their length of service and management status.

Other benefitsCars or car allowances have become a less common benefit. They can still be expected where a role requires significant travel and also for senior hires. In terms of overall remuneration a car allowance is frequently offered in lieu of a car and is often considered as non-pensionable salary when evaluating overall remuneration. A more common benefit for those working in London is a location allowance. This is a supplement for those working in London to cover the increased cost of either living in or commuting to London. The most valuable other benefit is Critical Illness Cover which is expensive to provide and is usually restricted to senior roles. However, Private Health Insurance is common and is often extended to all immediate family members.

Life assurance, usually linked to a pension scheme is usual as is payment of at least one professional subscription. Other benefits may include season ticket loans in London, gym membership, subsidised dental care, personal and accident insurance and staff discounts. These are generally low value benefits.

Security practitioners reported they received other benefits in 2016 with an average value of £4,600, a fall from £5,700 in 2015. This fall appears consistent with other areas of corporate governance. At £7,400 managers receive significantly higher other benefits than non-managers at £4,500, as do those working for larger employers.

Holiday entitlement The most common number of days’ holiday enjoyed by 36% of security practitioners is 25 days, with 50% surveyed reporting between 25 to 28 days’ holiday. The average number of days holiday survey-wide is 26 days, the same as in 2015. However, outside of the public sector where it was 29 days, all other sectors reported an average of 25 days. holiday entitlement, regardless of sector, is more likely to be enhanced by the number of years worked rather than seniority. As a strategy it represents a good way of rewarding loyalty and retaining staff but a poor way of attracting new employees.

An increasingly popular benefit is to provide employees with the opportunity to buy additional holidays. This is usually limited to an additional 5 days and would be purchased through salary sacrifice.

Flexible working Flexible working is the opportunity to vary hours and to work from home. It is a popular benefit with 70% of security practitioners reporting they would like to work more flexibly and 26% of security practitioners reporting they moved for a better work / life balance. Given that 81% of security practitioners reported they benefited from flexible working having changed job, against the 76% who had not, it is clear that prospective employers are aware that the opportunity to provide some element of flexible working has become part of the expected overall agreement. It was surprising therefore that there was a marginal fall in the overall percentage of security practitioners who reported they had the opportunity to work flexibly, down from 83% in 2015 to 79% in 2016. There is little difference between men and women, although managers are more likely to benefit from flexible working than non-managers. Surprisingly perhaps, flexible working was least common in the public sector and at the same consistent 80/81% across other sectors.

Employers are ultimately more concerned with output rather than simply attendance. Flexible working is an effective means of retaining staff and few employees, once they have benefited from it, would be prepared to give it up.

11

The composition of the sample ranged across all areas of security. Here are some key statistics:

Sample

p The proportion of women working in security, although low compared to other areas of corporate governance, having jumped in 2015, has again increased in 2016

p 9% of women have worked in security for less than 2 years against only 3% of men, which should result in the proportion of women working in security continuing to rise

p There are more women working in the public sector (15%) and resilience (14%) than in other sectors and disciplines

p Fall in respondents reporting they have management responsibility

p 76% of men describe themselves as managers versus 39% of women

Sub-group % Women

Banking & Financial Services 12%Commerce & Industry 8%Public Sector 15%Consultancy 7%IT Security 11%Information Security 11%Resilience 14%Corporate Security 6%Technology Risk 7%Data Protection / Privacy 13%Overall average 11%

5iiiGeneral Results

12

13

Q - Are you currently working?

Rise in proportion not working

p Percentage of security practitioners not working has risen, which is common with other areas of corporate governance

p This is skewed to two disciplines: corporate security where 9% reported not working and 6% in resilience. All other areas were comparatively low

p There has been a significant rise in the average time out of work security practitioners have been looking for work - in 2015 none reported looking for over 6 months, but this has jumped to 25% in 2016

p 72% of out of work security practitioners are finding it more difficult to find a new job than they anticipated, a significant rise on 47% in 2015

Q - How long have you worked in Security?

General findingsFurther increase in already high level of experience

p The average security practitioner has worked in security for 12.6 years in 2016, against 12.3 years in 2015

p 72% of security practitioners have worked in security for over 10 years

p Managers 13.2 years v non-managers 10.9 yearsp There is now no material difference between the

average length of time men and women have worked in security

13

Q - What was your primary motivation in looking for another job?

p Career development remains the key motivation and has risen in importance, with salary dropping in importance

p Women particularly interested in career development

p Not surprisingly, non-managers more focused on career development

p Career development high for those working in both consultancies and the public sector, with job security also high for those in the public sector

Career development increasing further in importance

Sub-group Career Development

Salary Work / Life Balance

Job Security

Men 45% 21% 28% 6%Women 58% 25% 9% 8%Managers 44% 23% 27% 6%Non-managers 55% 16% 23% 6%Banking & Financial Services 43% 22% 31% 4%Industry & Commerce 39% 24% 29% 8%Public Sector 52% 5% 26% 17%Consultancy 65% 18% 14% 3%Overall average 47% 21% 26% 6%

Q - Have you changed employer in the last 12 months?

Recruitment activity

More security practitioners changing job, particularly women

p Recruitment activity up on 2015p Surprisingly high 43% of women report changing

job in 2016 p Less surprisingly, non-managers more likely to

have changed job than managersp Security practitioners working in the consultancy

sector most likely to have changed job, those in the public sector least likely

p IT security practitioners most likely to have changed job

Sub-group Changed Job

Men 30%Women 43%Managers 29%Non-managers 39%London 36%Rest of UK 31%Banking & Financial Services 33%Commerce & Industry 28%Public Sector 23%Consultancy 42%IT Security 41%Information Security 38%Resilience 36%Corporate Security 25%Technology Risk 25%Data Protection / Privacy 28%Overall average 31%

14

Q - Which band best describes your base salary?

Salaries

Average base salary in survey £89,800

Sub-group Average Salary

Men £90,900Women £79,200Managers £96,400Non-managers £72,300London £90,800Rest of UK £74,700Large companies £96,100Medium sized companies £78,900Small companies £78,300 Banking & Financial Services £101,900 Commerce & Industry £92,900Public Sector £73,600Consultancy £76,800IT Security £99,800Information Security £87,000Resilience £84,700Corporate Security £91,200Technology Risk £105,400Data Protection / Privacy £79,800Overall average £89,800

p In common with other areas of corporate governance, salary becomes more important for security practitioners who would consider moving, particularly for men

p Work / life balance comparatively more important to those working in commerce & industry and consultancy

p Job security reasonably consistent across all sub sectors

Q - If you were to look for another job or go for an interview what would be the most likely reason?

Sub-group Career Development

Salary Work / Life Balance

Job Security

Men 38% 36% 19% 7%Women 51% 25% 18% 6%Managers 40% 33% 20% 7%Non-managers 36% 43% 16% 5%Banking & Financial Services 47% 42% 6% 5%Commerce & Industry 38% 28% 26% 8%Public Sector 40% 51% 4% 5%Consultancy 32% 37% 26% 5%Overall average 35% 39% 19% 7%

15

Q - Which best describes how your current salary compares to your salary in your previous role?

Average salary increase for job movers drops from 17% to 16%

p Average increase achieved by security practitioners changing job was 16%, down from 17% in 2015

p Women achieved an increase of 18% against 15% for men

p Little difference between managers and non-managers

p Increase for security practitioners in London 20% against 18% outside of London

Sub-group Salary Increase 2015

Salary Increase 2016

Banking & Financial Services

22% 20%

Commerce & Industry 14% 14%Public Sector 11% 13%Consultancy 11% 12%Overall average 17% 16%

Q - Which option best describes your salary increase in the last year?

Average salary increase for non-movers 5.6%

p Average salary increase up from 4.9% to 5.6%p Surprising increase in the number of security

practitioners who report no increase in their base salaries

p Women reported 6.4% increase against 5.5% for men

p Managers 5.1% against 6.3% for non-managers

Sub-group Salary Increase 2015

Salary Increase 2016

Banking & Financial Services

5.2% 5.9%

Commerce & Industry 4.3% 5.4%Public Sector 2.2% 2.9%Consultancy 6.2% 6.5%IT Security 5.7% 5.9%Information Security 5.0% 6.2%Resilience 4.2% 5.6%Corporate Security 4.7% 4.4%Technology Risk 5.0% 5.1%Data Protection / Privacy 4.2% 5.3%Overall average 4.9% 5.6%

16

Sub-group Paid Bonus 2016

Managers 76%Non-managers 71%Large companies 83%Medium sized companies 63%Small companies 52%Banking & Financial Services 79% Commerce & Industry 81%Public Sector 42%Consultancy 66%Overall average 74%

p Marginal drop in the number of companies paying bonuses versus 2015

p Large companies far more likely to pay bonuses than small ones

p Commerce and industry almost twice as likely to pay bonuses than the public sector

Q - Does your employer pay a bonus?

BonusesMarginal drop in number of companies paying bonuses

Q - Overall do you believe you are adequately compensated?

Slight increase in satisfaction with remuneration

p Slight increase in levels of satisfaction, up from 56% to 58%

p No significant differences between London and the rest of the UK, men and women, or by management responsibility

p Greater dissatisfaction in smaller companies and particularly in the public sector

p As might be expected, changing job increases satisfaction, although still only to 64%

Sub-group % Satisfied

Men 57%Women 60%Managers 57%Non-managers 58%London 59%Rest of UK 56%Large companies 59%Medium sized companies 58%Small companies 51% Changed employer (12 months) 64%Not changed employer 55%Banking & Financial Services 63% Commerce & Industry 60%Public Sector 38%Consultancy 54%IT Security 60%Information Security 49%Resilience 67%Corporate Security 58%Technology Risk 70%Data Protection / Privacy 62%Overall average 58%

17

Q - Does your employer provide you with any pension benefits above the statutory minimum?

Pensions

Additional pension benefits not universal

p Managers more likely to receive additional pension benefits

p Large companies more likely to provide additional pension benefits, as is the public sector

Sub-group %

Managers 73%Non-managers 64%Large companies 75%Medium sized companies 73%Small companies 50% Banking & Financial Services 73% Commerce & Industry 69%Public Sector 81%Consultancy 63%Overall average 71%

Q - What contribution to your pension as a percentage of your salary does your employer make?

Average contribution slightly down, from 9.9% to 9.5%

p Average pension contribution in 2016 was 9.5%, against 9.9% in 2015

p Typical pension contribution in 2016 was 5-10%, received by 51%

p Contributions highest in the public sector

Sub-group Contribution

Managers 9.7%Non-managers 8.4%Large companies 9.8%Medium sized companies 9.4%Small companies 7.2% Banking & Financial Services 10.1% Commerce & Industry 9.3%Public Sector 11.4%Consultancy 7.6%Overall average 9.5%

Q - Which of these as a percentage of your salary best describes your last bonus?

Level of bonuses down to 20%

p Average bonus down from 22% in 2015 to 20% in 2016

p Significant increase in people not receiving bonuses, up from 3% in 2015 to 8% in 2016

p Managers benefit from bonuses far more than non-managers

p Lowest bonuses in public sector - 9%p Large companies best for bonuses, small

companies the worst

Sub-group % Bonus 2016

Managers 23%Non-managers 11%Large companies 21%Medium sized companies 19%Small companies 15% Banking & Financial Services 21% Commerce & Industry 24%Public Sector 9%Consultancy 12%Overall average 20%

18

Q - What is your holiday entitlement?

Quality of life

Average holiday entitlement remains at 26 days

p Average holiday entitlement remains at 26 days, courtesy of longer holiday entitlement in the public sector

p The most common holiday entitlement is 25 days, enjoyed by 36% of security practitioners

p 47% of security practitioners benefit from between 24-27 days

p 14% of security practitioners only benefit from 20 or less days’ holiday

Q - What is the approximate monetary value of any other benefits such as health, travel or car allowances?

Other benefits

Significant fall in the value of other benefits

Sub-group value of Benefits

Managers £7,400Non-managers £4,500Large companies £7,600Medium sized companies £5,400Small companies £3,700Banking & Financial Services £4,100 Commerce & Industry £4,900Public Sector £3,200Consultancy £5,100Overall average £4,600

Sub-group Holiday Entitlement

Banking & Financial Services 25 daysCommerce & Industry 25 daysPublic Sector 29 daysConsultancy 25 daysOverall average 26 days

p Average value of other benefits has dropped from £5,700 in 2015 to £4,600 in 2016

p Managers and those working for large companies benefit most

p Consultancy offers highest benefits, the public sector the lowest

19

Q - Does your employer provide you with the opportunity to work flexibly to any significant level?

Slight fall in flexible working

p Slightly surprising fall in flexible working in 2016p Also surprising that more men report benefiting from

flexible workingp Flexible working less likely to be available in the

public sector p Changing job appears to increase the likelihood of

flexible working

Sub-group Flexible Working

Men 80%Women 77%Managers 76%Non-managers 85%Large companies 81%Medium sized companies 72%Small companies 77%Changed employer (12 months) 81%Not changed employer 76%Banking & Financial Services 81%Commerce & Industry 81%Public Sector 65%Consultancy 80%Overall average 79%

Sub-group Desire to Work Flexibly

Men 71%Women 68%Managers 72%Non-managers 64%Large companies 68%Medium sized companies 74%Small companies 71%Changed employer (12 months) 70%Not changed employer 70%Banking & Financial Services 73%Commerce & Industry 66%Public Sector 81%Consultancy 73%Overall average 70%

Q - Would you like the opportunity to work more flexibly?

Desire for even more flexible working

p Desire particularly strong in the public sector

20

Q - Do you feel your skills have become more or less valuable?

General consensus that value of skills is increasing

p Feeling about value of skills strongest in IT security and information security

p Security practitioners who have changed job feel more secure

p Confidence lowest in Banking & Financial Services

p IT security practitioners feel most secure

Q - Do you feel more or less secure than a year ago?

how people are feeling

30% feeling less confident

Sub-group More Same Less

Managers 23% 44% 33%Non-managers 24% 55% 21%Changed employer (12 months) 39% 40% 21%Not changed employer 15% 52% 33%Banking & Financial Services

19% 50% 31%

Commerce & Industry 25% 45% 30%Public Sector 23% 58% 19%Consultancy 24% 57% 19%IT Security 40% 35% 25%Information Security 25% 52% 23%Resilience 24% 41% 35%Corporate Security 20% 45% 35%Technology Risk 15% 57% 28%Data Protection / Privacy 22% 50% 28%Overall average 23% 47% 30%

Sub-group More Same Less

Managers 67% 20% 13%Non-managers 66% 29% 5%Earning >£80k 69% 24% 7%Earning <£80k 64% 22% 14%IT Security 80% 15% 5%Information Security 72% 16% 12%Resilience 65% 21% 14%Corporate Security 62% 26% 12%Technology Risk 60% 29% 11%Data Protection / Privacy 65% 22% 13%Overall average 67% 22% 11%

21

Q - What would you most like to change about your job?

Salary the most important issue

p Although career development runs it close and work / life balance is important, salary is the key issuep Salary particularly important to non-managersp 16% of people in the public sector and 11% of women feel they lack recognition

Sub-group Salary Work / Life Balance

Job Content Career Development

Job Security My Manager Recognition

Men 31% 18% 10% 27% 7% 2% 5%Women 20% 28% 16% 15% 2% 8% 11%Managers 28% 20% 11% 26% 8% 2% 5%Non-managers 40% 15% 8% 22% 3% 4% 8%Banking & Financial Services 27% 19% 11% 28% 8% 3% 4%Commerce & Industry 27% 18% 11% 28% 8% 3% 5%Public Sector 42% 4% 8% 23% 4% 3% 16%Consultancy 39% 18% 5% 26% 6% 0% 6%Overall 31% 19% 10% 25% 7% 2% 6%

22

23

Q - Do you think the market for your skills is improving or deteriorating?

Q - Are you satisfied with your current contract?

Q - When considering a new contract, what is the most important consideration?

Contractors in work

Q - Do you believe you are adequately compensated?

Q - How quickly were you able to secure your current contract?

Q - Which best describes how your current rate compares with your previous rate?

Barclay Simpson analyses the salary data that accumulates from the placements we make in the UK. This provides a guide to salaries for security practitioners.

The salary ranges quoted are for good rather than exceptional individuals and take no account of other benefits in addition to salary, such as bonuses, profit sharing arrangements and pension benefits.

5ivSalary Guide

24

SeLecTed PrOfILeS - PerMAnenT LONDON REST OF uk

Senior Data Protection Analyst Team member in a small DP department for a large mobile telecommunications group. Proven experience in a similar role and ISEB qualified.

£49 – 54,000 £40 – 46,000

Security AnalystGeneric information and IT security consulting and project delivery in a large retail financial services group.

£49 – 60,000 £42 – 52,000

Senior Security Consultant Working for an SI, undertaking security consultancy and delivering on security projects for a large-scale client. Senior person also involved in bid / proposal work and mentoring team members.

£56 – 74,000 £50 – 68,000

CCP Senior level in a security practice of a large consultancy or SI. Skills in security architecture, security policy formulation and review, and risk assessment. Also undertakes business development activities.

£60 – 95,000 £55 – 85,000

Senior Business Continuity Consultant Working for a large consultancy firm, delivering and managing consulting engagements and in some cases managing junior staff. Some sales and business development responsibility.

£64 – 70,000 £56 – 62,000

PCI QSAPracticing QSA working with external clients and managing their entire PCI compliance programme.

£67 – 78,000 £57 – 67,000

SIEM ConsultantTechnical specialist with strong skills with a leading SIEM solution such as ArcSight or RSA envision. Design, implementation and integration experience. Client facing consultative role.

£67 – 85,000 £57 – 75,000

Identity & Access Management ConsultantSolid skills in identity and access management design and architecture. Background of working in consultancy, with good client-facing skills and bid work experience.

£70 – 80,000 £63 – 70,000

Security & Compliance ManagerSecurity Manager responsible for the business meeting compliance standards such as ISO27001 and PCI.

£75 – 85,000 £65 – 72,000

Security ManagerSecurity background in a small financial services company. Demonstrable management experience. No permanent reports. Will utilise consulting firms and contractors on an ad-hoc basis.

£80 – 88,000 £70 – 80,000

25

SeLecTed PrOfILeS - PerMAnenT (cOnTInued) LONDON REST OF uk

EMEA Manager of Data ProtectionMedium to large insurance group. No direct reports. EU Data Privacy legislation experience.

£79 – 89,000 £67 – 73,000

Network Security Team LeaderWorking in a FTSE 100 group leading a team of 6-8 network security specialists, reporting directly to the Head of Security. 10 years experience.

£84 – 92,000 £72 – 80,000

Head of Business Continuity Major financial services group, a large team to manage / supervise. Established career history within BCM.

£112 – 130,000 £96 – 105,000

Head of SecurityManaging a team of 8 security professionals in a financial services company, assisted by 2 more junior managers. Significant management experience and wide security experience.

£128 – 146,000 £94 – 100,000

SeLecTed PrOfILeS - cOnTrAcT LONDON REST OF uk

Data Privacy Analyst Experience of DPA 98 and EU Privacy Directive 95/46/EC, required to provide specialist privacy knowledge and support.

£425 – 475 per day

£350 – 400 per day

Security Monitoring AnalystAnalyst using various security solutions deployed within the IT environment, providing active monitoring, identification, notification and response to internal and external threats and recommendation for the mitigation of risks.

£425 – 450 per day

£400 – 450 per day

Business Continuity ConsultantManaging a team of 8 security professionals in a financial services company, assisted by 2 more junior.

£475 - 500 per day

£400 – 450 per day

Security Consultant Providing security advice across the business, ranging from policy review and development, to information risk reviews. Holds CISSP or CISM.

£525 – 600 per day

£500 – 550 per day

Penetration Tester SME in application security, code reviews and vulnerabilities, attacks and countermeasures with a deep knowledge of hacking and penetration testing techniques, methodologies and tools across web application and infrastructure.

£500 – 600 per day

£450 – 550 per day

SIEM ConsultantTechnical Specialist with strong skills with leading SIEM solution such as ArcSight or RSA envision. Design, implementation and integration experience.

£550 – £575 per day

£500 – £550 per day

Technology Risk Consultant Good technical understanding with the ability to identify, assess, manage and report risk. Working with different projects within the organisation on varying technologies.

£550 – 600 per day

£525 – 550 per day

Application Security ConsultantConsultant will need to identify appropriate security controls, as well as carry out code reviews of J2EE enterprise applications, penetration tests, tracking new requirements and recommending improvements.

£550 – 600 per day

£550 – 600 per day

PCI ConsultantPCI Consultant who can work with the client to ensure compliance to the PCI-DSS standards.

£550 – 600 per day

£550 – 600 per day

26

SALARy ChART - END uSERS Banking non-Banking

FS

COmmERCIAL fTSe 100

EQuIVALENT

COmmERCIAL fTSe 250 Or

SmALLER

Info Security Analyst 2 yrs £37 – 41,000 £35 – 38,000 £32 – 34,000 £30 – 33,000

Data Protection Analyst 2 yrs+ £36 – 42,000 £36 – 42,000 £36 – 42,000 £35 – 40,000

Business Continuity Analyst 2 yrs + £37 – 46,000 £37 – 46,000 £36 – 42,000 £31 – 40,000

Info Security Analyst 3 yrs £45 – 49,000 £39 – 46,000 £37 – 43,000 £31 – 35,000

Info Security Analyst 4 yrs + £55 – 65,000 £50 – 56,000 £43 – 52,000 £38 – 44,000

Data Protection Manager (5 yrs + no team) £65 – 90,000 £58 – 80,000 £55 – 85,000 £55 – 80,000

Business Continuity Manager (4 yrs + no team) £70 – 90,000 £58 – 85,000 £50 – 75,000 £45 – 68,000

Info Security Manager (team under 5) £80 – 105,000 £73 – 95,000 £70 – 90,000 £68 – 90,000

Info Security Manager (team 5+) £90 – 125,000 £88 – 120,000 £85 – 110,000 £77 – 100,000

Head of Info Security (dept under 10) £118 – 160,000 £115 – 146,000 £110 – 135,000 £90 – 126,000

Head of Info Security (dept 10+) £170,000+ £150,000+ £150,000+ N/A

SALARy ChART - CONSuLTANCIES AND SIS Big 4

SyStemS integrator

LARGE CONSuLTANCy

BOuTIQuE CONSuLTANCy

Penetration Tester (under 4 years exp) £35 – 50,000 £35 – 55,000 £35 – 55,000 £35 – 60,000

Consultant £36 – 55,000 £35 – 55,000 £38 – 60,000 £40 – 60,000

CHECK Team Member £40 – 55,000 £40 – 55,000 £40 – 65,000 £40 – 65,000

Senior Consultant £44 – 60,000 £45 – 70,000 £45 – 70,000 £47 – 75,000

Manager £56 – 80,000 £62 – 87,000 £62 – 90,000 £62 – 90,000

CHECK Team Leader £58 – 90,000 £60 – 85,000 £60 – 85,000 £65 – 90,000

Senior Manager £72 – 110,000 £70 – 95,000 £70 – 95,000 £70 – 100,000

Director (Practice Lead) £100 – 148,000 £90 – 130,000 £95 – 130,000 £95 – 130,000

Barclay Simpson is an international corporate governance recruitment consultancy specialising in internal audit, risk, compliance, security, business continuity, legal and treasury appointments. established in 1989, Barclay Simpson works with clients in all sectors throughout the uk, Europe, middle East, North America and Asia-Pacific from our offices in London, new york, Dubai, hong kong and Singapore.

We add value by using our unique focus on corporate governance, our highly experienced specialist consultants and access to both the local and international pools of corporate governance talent. Our strength lies in our ability to understand client and candidate needs and then to use this insight to ensure our candidates are introduced to positions they want and our clients to the candidates they wish to recruit.

For more in-depth coverage, comprehensive reports and compensation guides exist for the Internal Audit, Risk, Compliance, Security and Legal recruitment markets. These can be accessed from the links below.

We also produce other specialist reports, each of which can be accessed for free on our website: www.barclaysimpson.com

www.barclaysimpson.com/mid2016markettrends/auditwww.barclaysimpson.com/mid2016markettrends/riskwww.barclaysimpson.com/mid2016markettrends/compliancewww.barclaysimpson.com/mid2016markettrends/securitywww.barclaysimpson.com/mid2016markettrends/legal

ABOUT BARCLAY SIMPSON6Barclay SimpsonBridewell Gate, 9 Bridewell PlaceLondon EC4V 6AWTel: 44 (0)20 7936 2601Email: bs@barclaysimpson.com

27

If you would like to discuss any aspect of the reports please contact the following divisional heads:

Corporate Governance Adrian Simpson as@barclaysimpson.comInternal and IT Audit Tim Sandwell ts@barclaysimpson.comRisk Dean Spencer ds@barclaysimpson.comCompliance Tom Boulderstone tgb@barclaysimpson.comSecurity Mark Ampleford ma@barclaysimpson.comLegal Jane Fry jf@barclaysimpson.com

To discuss our international services please contact:Europe Tim Sandwell ts@barclaysimpson.comMiddle East Chris L’Amie cla@barclaysimpson.comAsia Pacific Russell Bunker rb@barclaysimpson.comNorth America Daniel Close dc@barclaysimpson.com