Rambøll

Denmark · owned by RAMBØLL FONDEN (Denmark) · www.surveyxact.dk · 6 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 6 sub-vendors.

Insights

Last updated 2026-09-13 · revision 1

6 direct vendors, 141 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Rambøll's migration readiness is moderate, largely constrained by its reliance on

Compliance

8 in-scope frameworks identified; showing 3.

ISAE 3000 (source) — Compliant

ISAE 3000-II compliance is explicitly confirmed through an annual audit conducted by PwC. This is directly referenced on the official GDPR compliance page as a core security assurance mechanism. ISAE 3000-II is the European standard for assurance engagements over controls at service organizations (equivalent to SOC 2 in the US context). The annual PwC audit provides independent third-party verification of the technical and organizational security measures described in data processor agreements. Risk is Low because the audit is conducted annually by a Big Four firm (PwC), the reports are provided to customers as contractual deliverables, and the framework is well-established. Residual risk relates to the period between annual audits.

Evidence: https://rambollxact.dk/gdpr, https://rambollxact.dk/iso-certificering, https://rambollxact.dk/datahaandtering

WCAG — Assessment Required

SurveyXact explicitly lists WCAG compliance as a dedicated compliance area on its website, indicating active engagement with accessibility requirements. In Denmark, WCAG 2.1 AA compliance is mandatory for public sector websites and digital services under the Web Accessibility Directive (EU 2016/2102), transposed into Danish law. As SurveyXact serves a large number of Danish public sector clients (municipalities, hospitals, educational institutions), WCAG compliance is a legal requirement for those deployments. Risk is Medium because non-compliance with WCAG for public sector deployments could result in regulatory action and loss of public sector contracts, which appear to be a significant portion of the customer base.

Evidence: https://rambollxact.dk/wcag, https://rambollxact.dk

SOC 2 (source) — Assessment Required

SurveyXact is a cloud-based SaaS platform that stores and processes customer data, making SOC 2 directly relevant as a trust framework. While the company has an annual ISAE 3000-II audit by PwC (which is the European equivalent/counterpart to SOC 2), there is no public evidence of a formal SOC 2 Type I or Type II report. International enterprise customers, particularly those with US operations or US-based parent companies, may require SOC 2 reports as part of vendor due diligence. The absence of a SOC 2 report could be a commercial risk for enterprise sales into markets where SOC 2 is the expected standard. Risk is Medium because the ISAE 3000-II audit provides substantial equivalent assurance for European customers, but the gap may affect international expansion.

Evidence: https://rambollxact.dk/gdpr, https://rambollxact.dk/iso-certificering, https://rambollxact.dk/datahaandtering

Financials

Three-year financials

Financial Resilience Score: 7/10

Rambøll Group demonstrates solid financial resilience, anchored by its foundation ownership structure (Rambøll Foundation holds the majority), which provides long-term stability, no dividend pressure from listed-market investors, and strong reinvestment capacity. The group has grown consistently from DKK 9.4B in 2015 to approximately DKK 16B in 2024, representing a CAGR of roughly 6-7%, driven by a combination of organic growth and selective M&A activity (Henning Larsen 2018, OBG 2020). EBIT margin has trended upward from ~3% in the late 2010s toward ~5% as Rambøll executed its 'The Partner for Sustainable Change' strategy. The group benefits from diversified end-markets (buildings, transport, water, environment & health, energy, and management consulting) and a broad geographic footprint across the Nordics, UK, Germany, and the US, with rising activity in India and the Middle East. Structural tailwinds from the green transition, energy infrastructure, water management, and decarbonization support ongoing demand for Rambøll's core services. A strong equity base and low financial leverage—typical of Danish foundation-owned engineering groups—provide additional buffer. However, the score is constrained by a modest EBIT margin of ~4-5% compared to global peers like WSP, AECOM, or Arcadis, which leaves less buffer in a downturn. As a consultancy, ~65-70% of costs are staff-related, making the business highly sensitive to wage inflation in the Nordics and utilization rates. FX exposure to GBP, USD, SEK, NOK, and EUR adds translation risk.

Key strengths: Foundation ownership (Rambøll Foundation) provides long-term stability and reinvestment capacity, Diversified end-markets across buildings, transport, water, environment, energy, and consulting, Broad geographic footprint across Nordics, UK, Germany, US, India, and Middle East, Strong equity base and low financial leverage, Structural tailwinds from green transition, energy infrastructure, and decarbonization, Consistent revenue growth (~6-7% CAGR 2015-2024) with improving EBIT margins

Risk factors: People-cost sensitivity: ~65-70% of costs are staff; wage inflation compresses margins, Utilization risk: profitability depends on billable hours; sensitive to construction/property cycles, Modest EBIT margin (~4-5%) compared to global peers leaves less downturn buffer, Acquisition integration risk and recurring goodwill on balance sheet from M&A activity, FX exposure to GBP, USD, SEK, NOK, and EUR translation effects

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report