Report and Accounts for 2019 and AGM 2020

Setting the tone ®

Designing the system ®

Completing the review

The Board

Accountable for carrying out a robust assessment of the principal risks facing Vectura, including those threatening its business model, future performance, solvency and liquidity.

Responsible for conducting an annual effectiveness review of Vectura's risk management and internal control systems, and the principal risks facing Vectura. This review covers all material controls, including financial, operational and compliance controls.

Responsible for reporting to shareholders about Vectura's risk management process.

Executive Leadership Team

Responsible for ensuring that the risk management and internal control systems are appropriately designed, implemented and aligned to the Board's risk appetite.

Responsible for ensuring that the risk appetite of the Board is appropriately understood by risk owners and key decision makers.

Responsible for reviewing thebusiness-wide and project risk registers.

Responsible for conducting an annual assessment of its key principal risks to ensure controls are in place and, where gaps are identified, plans are assigned to address them.

Project managers and senior leaders

Responsible for updating project and functional risk registers and reporting those considered key to the Executive Leadership Team.

Responsible for implementing and monitoring mitigating actions and controls.

Responsible for informing project and functional teams about risks and ensuring that mitigating actions are carried out.

Review of process and outputs

¬ Review of high risks

¬ Risk registers

Short-term supply chain disruption from the UK exiting the implementation period on 31 December 2020 without agreeing a beneficial trading relationship with the EU (a "hard" Brexit)

Adverse regulatory changes resulting in higher operating costs over the short, medium and longer term

Risk movement:

Corporate Goals impact:

Risk movement:

Corporate Goals impact:

Stable

1, 4

Stable

1, 4

What is the risk?

The Group's largest single product, flutiform®, is manufactured in the UK and commercialised by its partners in Europe, Japan and Rest of World. The Group imports raw materials into the UK and the Group's partners export flutiform® from the UK into overseas markets. Delays to cross-border movement of goods could disrupt the flutiform® supply chain.

What would the impact be?

Major disruption to the flutiform® supply chain could result in lost product supply revenues and lost in-market sales which generate royalties for Vectura. If in-market sales are lost, patients may switch to alternative products and not switch back when availability returns.

What could cause the risk to be realised?

• Disruption at ports of entry and exit which significantly slows the movement of goods such that stocks of products in overseas markets cannot be sufficiently replenished, or imports of raw materials are limited, reducing manufacturing output below normal levels.

• Alternative routings or methods of transportation are unavailable.

• New flutiform® release testing capability for the EU does not perform to the required level, slowing or reducing the release of batches into the EU.

How do we manage the risk?

• Partners have reviewed stock levels in light of Brexit risks, and these have been increased where deemed appropriate. Mitigation of these risks is reviewed regularly by the Group and its partners.

• The Group has reviewed its raw material inventory levels and has built stocks where appropriate.

• Vectura, partners and suppliers have engaged third-party logistics providers with import and export expertise.

• Alternative routings or methods of transportation available to Vectura, suppliers and partners have been reviewed and contingency plans developed.

• Training of internal supply chain staff on import/export complexities has been undertaken.

• Provision for flutiform® release testing in the EU has been implemented.

What is the risk?

If the UK fails to agree a beneficial trading relationship before the transition period ends on 31 December 2020, future trading with the EU and other countries may result in increased costs for Vectura, for example costs associated with the application of new import or export tariffs.

In addition, from a regulatory perspective, an EU legal entity is required for medicinal product and medical device submissions and clinical trials in the EU. Vectura also requires a notified body with a legal entity in the EU. A notified body conducts conformity assessments for European directives related to medical devices.

What would the impact be?

Trading with the EU without a free trade agreement could impact the Group as follows:

• tariffs on raw materials imported from the UK for flutiform® reducing product supply margins. These are incurred directly or via supplier price increases;

• additional testing or regulatory compliance costs to Vectura, which erode product supply margins; and

• adverse regulatory changes increase costs of compliance, constraining funds for investment.

What could cause the risk to be realised?

A beneficial trading relationship between the UK and EU is not established before the transition period ends on 31 December 2020.

Insufficient expertise and resources are available to deal with increased compliance activity.

How do we manage the risk?

• The Group has sought out guidance and intelligence from the relevant professional bodies and trade organisations to shape its planning.

• The Group has established a legal entity within the EU to enable it to comply with EU regulations for medicinal products and devices. The Group has also appointed a new EU notified body.

• The Group has established a capability to perform EU release testing post 31 December 2020.

• Resource and training requirements have been assessed and actioned accordingly.

Failure to win new customer contracts for development services and execute these profitably

Supply chain disruption

Risk movement:

Corporate Goals impact:

Risk movement:

Corporate Goals impact:

New risk

1, 2

Stable

1, 4

What is the risk?

Developing a strong pipeline of opportunities and converting these opportunities into revenues is critical to the success of the new CDMO business model.

In addition, Vectura must be able to deliver customer requirements profitably which requires efficient management of development capacity and investment in new technologies and intellectual property.

What would the impact be?

Vectura is unable to deliver growth from competing in the inhaled CDMO market.

What could cause the risk to be realised?

• Insufficient investment in business development resources and marketing to drive presence and awareness.

• Organisation structure, processes and systems not fit for purpose.

• Market offering not competitive, for example: pricing, technology and delivery timelines.

• Inefficient cost base to deliver inhaled development services.

How do we manage the risk?

• The recently appointed CEO brings a wealth of CDMO experience.

• The Group is recruiting experienced business development personnel in the EU and US and investing in branding and marketing.

• A technology roadmap is in place which is reviewed annually. Funding for execution of the roadmap is in place.

• A CDMO strategy implementation project is in place with appropriate governance and resourcing by experienced senior leaders.

• KPIs have been defined and are currently being implemented to track progress on business development and operational efficiency.

• Financial targets set and finance business partners in place to support delivery of an efficient cost base and appropriate pricing of services.

What is the risk?

Vectura manages the supply chain for certain commercial products (flutiform®, AirFluSal® Forspiro® and Breelib™) and also relies on suppliers for the provision of quality compliant materials for R&D.

What would the impact be?

Major disruption to, or failure of, these supply chains, particularly for flutiform®, could result in lost revenues and business opportunities, stock shortages, liabilities and significant damage to profitability and prospects for Vectura. Such disruption could be either quality or capacity related.

What could cause the risk to be realised?

• Supply chain disruption involving a single point of failure for which Vectura has high dependency and limited resilience.

• Supplier capacity constraints.

• Supplier loss of licence or regulatory action impacting Vectura.

How do we manage the risk?

• Vectura has strong working relationships with its suppliers; we have established due diligence processes to ensure that our stringent quality standards are maintained and we have put in place appropriate systems that will provide an early warning of potential issues.

• A dedicated Commercial Quality Director has oversight of release of commercial product and ensures appropriate management of quality for commercial products.

• Monthly meetings are held to discuss customer demand forecasts and to review Vectura's ability to meet these forecasts. Vectura has established contingency arrangements to ensure that production capacities exceed forecast demand so that it would be possible to catch up on any shortfall in production or meet unexpected demand. Appropriate levels of safety stock are maintained.

• Supply chain mapping has been undertaken, and is regularly reviewed, to identify potential points of failure and mitigating actions. Where economically feasible, additional sources of supply are established and contracts negotiated to include appropriate provisions for replacement of defective goods.

• The Group also has appropriate insurance, but it is not possible to insure against all risks and not all insurable risks can be fully insured on an economically feasible basis.

Failure to launch VR315 (US) in a competitive timeframe

Failure of partners to deliver on their obligations

Risk movement:

Corporate Goals impact:

Risk movement:

Corporate Goals impact:

Decreasing

1, 3

Stable

1, 4

What is the risk?

On 10 May 2017, our partner, Hikma Pharmaceuticals PLC ("Hikma"), received a Complete Response Letter (CRL) from the US FDA in relation to its abbreviated new drug application for its generic version of GSK's Advair Diskus®. This CRL was categorised as "Major".

In November 2019, Hikma submitted responses to the US FDA for review, which includes data from a further clinical endpoint study.

Vectura believes the submission addresses the outstanding questions raised by the FDA in its CRL and remains confident in the prospects for the approval of VR315 (US).

If VR315 (US) is approved, we are likely to be the second generics company on the market after Mylan and the third generic including the authorised generic distributed by Prasco Laboratories.

What would the impact be?

The product is launched later than those of competitors resulting in loss of potential future revenues and funds for investment.

What could cause the risk to be realised?

• VR315 (US) not being the second generic of GSK's Advair Diskus® product.

• Sales (volumes and/or pricing) of GSK's Advair Diskus® could decline faster than expected prior to launch of VR315 (US).

How do we manage the risk?

• The Group is unable to take direct action to mitigate this risk.

• We will continue to support Hikma in responding to any queries raised by the US FDA to the November 2019 resubmission. In addition, we will continue to monitor the market and progress of competitors.

Risk movement

Decreasing following resubmission in November 2019 and Sandoz discontinuing development of its generic version in 2020.

What is the risk?

Vectura earns revenues from a number of partnered in-market assets, most notably flutiform®, and is dependent upon these partners for maintaining regulatory approvals and for the marketing of the products. Development service revenues also depend on partners delivering on their obligations in order for programmes to progress to plan.

Royalty revenues depend on partners both to generate sales of the product but also to accurately calculate and pay over royalties according to the terms of the licence.

What would the impact be?

Failure of a partner to maintain regulatory approvals, to comply with relevant codes or regulations, or to commit an appropriate level of resource could result in loss of product supply revenues to Vectura.

Failure by a development partner to deliver on their obligations during the development phase could result in a delay or cessation of development. This in turn could cause a delay in development activities which could reduce revenues. It may also delay the product reaching the market which could undermine the product's commercial potential and result in lower returns on investment for Vectura.

The marketing, supply chain and commercialisation strategies deployed by partners for existing on-market products could materially impact the level of royalties and sales milestones earned by Vectura.

What could cause the risk to be realised?

• Change in partner strategy or priorities.

• Partner viability or insolvency.

• Partner's marketing, supply chain or commercialisation strategy is sub-optimal or not executed successfully.

• Partner failure to obtain appropriate pricing and reimbursement.

• Partner failure to comply with relevant legislation or regulations.

• Partner failure to comply with the terms of a licence.

How do we manage the risk?

• All collaborations are performed under a suitable legal agreement which is assessed by Vectura and its legal advisors. Non-performance of these obligations can result in escalation within the partner organisation, or appointment of a third-party audit, independent arbitration or, in extreme cases, legal action.

• Typically, for collaborations, a joint steering committee (JSC) is established involving both Vectura and partner personnel. This provides Vectura with a mechanism to ensure that any joint project activity is managed appropriately, and where concerns can be escalated.

• At a product or project level, regular operational meetings take place to review progress, plans and forecasts.

• The Group also has a Commercial and Business Development department which maintains regular dialogue with existing and potential new partners.

Failure or delay in achieving development milestones required to advance the generic product pipeline

Failure to develop the FOX® nebuliser platforms to secure future growth in new customer contracts

Risk movement:

Corporate Goals impact:

Risk movement:

Corporate Goals impact:

Stable

1, 4

Stable

1, 2, 4

What is the risk?

Failure or delay in achieving development milestones for the Group's generic programmes would have a material adverse impact on the value of these programmes.

What would the impact be?

Termination of projects or significant delays could materially affect future revenues, profitability and prospects of Vectura.

What could cause the risk to be realised?

• Manufacturing issues associated with a particular device or product for clinical trials.

• Ineffective design and execution of development activities.

• Insufficient capacity or prioritisation of competing projects.

How do we manage the risk?

• Vectura has an established governance process to oversee the conduct and delivery of all development programmes and to ensure that any potential changes to the development plan or budget are identified and discussed in a timely manner, such that mitigating activities or actions can be put in place as required.

• Individuals with the necessary skills and experience have been recruited to lead and oversee the development of our generic pipeline assets. Vectura continues to work with a network of experienced consultants and contractors who provide additional support and expertise as required.

• Operational excellence initiatives within the development function have been and continue to be implemented to maximise development capacity.

What is the risk?

The Group receives significant interest in its FOX® nebuliser technology from existing and prospective customers.

The Group is also in the process of closing down its German site, where its nebuliser technology originated.

Continuing to develop this technology is critical to securing future growth in customer contracts as a provider of inhalation development services.

What would the impact be?

Failure to be competitive versus other similar platforms, and risk losing current or future revenue opportunities.

What could cause the risk to be realised?

• Failure to transfer knowledge and skills to the UK from the Group's German site following the announcement of the German site closure in 2018.

• Failure to develop the platform to respond to customer demands and a growing range of formulations.

• Failure to maintain quality standards.

How do we manage the risk?

• In respect of the closure of the Group's German site, transition of knowledge is progressing well. A retention scheme is in place for key employees from the closing site and resources have been recruited into receiving sites in the UK. A transition team continues to exercise oversight.

• We work closely with our third-party suppliers to continue to improve the platform, including processes, controls and components. These processes and controls are documented, and supplier audits ensure they are operated. Remediation is undertaken where issues are identified.

• An integrated Programme team ensures all activities which impact the development of the FOX® nebuliser platform are managed cohesively.

Changes in the regulatory, operating or pricing environment

Failure to attract or retain talent/key personnel

Risk movement:

Corporate Goals impact:

Risk movement:

Corporate Goals impact:

Stable

1, 2

Stable

3, 4

What is the risk?

Vectura operates in the highly regulated international pharmaceutical industry, which is subject to change.

What would the impact be?

Changes in the pharmaceutical regulatory landscape, operational restrictions and downward pricing pressure could adversely impact:

• the number and value of customer opportunities to provide development services; and

• the value or viability of the generic pipeline products or those products already developed and commercialised by partners.

What could cause the risk to be realised?

• Political change.

• Competitor pricing strategies.

• Regulatory action on pricing.

How do we manage the risk?

• Regulatory changes tend to be considered due to lengthy consultations and discussions between regulators and the pharmaceutical industry. We work closely with expert regulatory advisors and, when appropriate, seek advice from regulatory authorities on the design of key development plans for pre-clinical and clinical programmes.

• We work with a number of blue-chip pharmaceutical partners who have significant regulatory expertise.

• Our technology roadmap is reviewed at least annually and takes account of evolving market trends, customer needs and the competitive landscape.

What is the risk?

Vectura relies upon a number of key qualified management, scientific, technical, marketing and support personnel. Competition for such personnel is intense and there can be no assurance that the Group will be able to continue to attract and retain such personnel.

What would the impact be?

The loss of talent or key personnel could adversely impact the effectiveness of the Group's operations.

What could cause the risk to be realised?

• Inadequate succession planning and talent management.

• Organisational disruption and/or change.

• Failure of reward and/or incentive strategy.

How do we manage the risk?

• Vectura seeks to develop employees for current and future roles and our career development and talent management programmes remain a key area of focus for the Executive Leadership Team. We continue to invest in ongoing training and development with leadership and management development programmes in place.

• Succession plans for key roles have been developed to ensure a talent pool is identified, developed and ready for appointment. These plans include the identification of "emergency successors" in the case of unanticipated and immediate absence.

• Vectura regularly benchmarks its reward strategy to ensure it continues to incentivise, motivate and retain our talented employees. This benchmarking covers both short and long-term incentives. Salaries of all employees are reviewed annually to ensure we remain market competitive.

Failure to protect intellectual property

Failure to protect critical and sensitive data and systems

Risk movement:

Corporate Goals impact:

Risk movement:

Corporate Goals impact:

Stable

1, 2

New risk

4

What is the risk?

Patent infringement by a competitor organisation or failure to obtain patents for technology developed by Vectura could impact on the value of Vectura's market offering as a CDMO and inhibit the delivery of the generic pipeline.

What would the impact be?

Such infringement or failure could result in Vectura or a customer having to take a license to third-party IP in order to develop a product, or even being unable to commercialise a product, materially impacting Vectura's future revenues, profitability and prospects.

What could cause the risk to be realised?

• Competitor successful in challenging Vectura or partner patent.

• Critical information missing from filed patent.

How do we manage the risk?

• Dedicated internal resource, supplemented with external expertise, files for and prosecutes patents and other forms of intellectual property.

• In conjunction with our partners where relevant, Vectura takes steps to enforce these rights.

• Third-party rights that may be of interest to and/or have adverse effects on Vectura's activities are also monitored so that action can be initiated where appropriate.

What is the risk?

Data and information technology systems are critical to our operations. Significant disruption to systems due to computer viruses, cyber threats, malicious intrusions or unintended or malicious behaviour by employees, contractors or service providers could affect the Group's operations. In addition, such disruption may compromise the integrity of information and result in the inappropriate disclosure of confidential information, or may lead to false or misleading information about the Group.

The cyber security incidents that we have experienced to date have not resulted in significant disruption to our operations. However, as the threats evolve we cannot provide assurance that our efforts in protecting our systems and data will always be successful.

What would the impact be?

The loss of proprietary or other commercially sensitive information may provide competitors with a competitive advantage resulting in competitive or operational damage to the Group.

The disclosure of confidential information about the Group's employees, customers, suppliers or other third parties could also expose the Group to liability.

The potential for fraud from manipulation of payment processes.

Failure to effectively prevent or respond to a major breach or cyber-attack may also subject the Group to significant reputational damage.

What could cause the risk to be realised?

• Security vulnerability in our systems.

• External cyber-criminal activity.

• Employee or contractor non-maliciously introduces a vulnerability which is exploited by a malicious actor.

• Lack of employee training around the cyber threat.

How do we manage the risk?

• Security and access control standards in place with compliance monitored.

• Vectura has a dedicated security engineer who provides oversight and actively monitors cyber security.

• Daily backup of systems and data.

• Employee laptops and mobile phones are protected via secure encryption.

• Cyber security training provided to all employees.

• Cyber risk insurance cover in place.

• Ongoing programme to enhance our information and system security capabilities.

Short-term employee benefits

1.4

0.8

Annual incentive plan

0.7

0.7

Non-Executive Directors' fees

0.6

0.5

Post-employment benefits

0.1

0.1