BT 2014 Annual Report Download - page 53

650 The Strategic Report
Delivering our strategy
Our risks
ike all businesses, we are aected by a number
of risks and uncertainties. These may be impacted
by internal and external factors, some of which we
cannot control. Many of our risks are akin to those felt
by other companies of similar scale andoperation.
Principal risks and uncertainties
This section features some of the principal risks and uncertainties
aecting us, but it is not exhaustive. These risks have the potential to
impact our business, brand, assets, revenue, prots, liquidity or capital
resources. The principal risks we described last year have evolved,
and so has our response to them.
Our Enterprise Risk Management framework provides reasonable
(but cannot give absolute) assurance that signicant risks are identied
and addressed. There may be some risks which are unknown to us at
present. And there may be some that we consider less signicant now
but become more important later.
As in the prior year, external factors present both risks and opportunities,
both to our business and to others. Inevitably, there are uncertainties
in terms of the impact to BT should Scotland vote in favour of
independence in September 2014. We have performed a high-level
risk assessment of what those implications may be, and will continue to
monitor the issue, seeking clarication on key questions from relevant
parties where possible.
External factors drive a number of the risks that we face and we focus
our eorts on predicting and mitigating these, while at the same time
seeking to capitalise on opportunities that may emerge.
In the principal risks section below, we talk about what we are doing to
stop our main risks materialising, or to limit their impact. Our principal
risks and uncertainties should be considered in conjunction with our risk
management process, the forward-looking statements in this document
and the cautionary statement regarding forward-looking statements.
<ou can read the cautionary statement regarding
forward-looking statements on page 192
How we manage risk
We need to manage risk so we can meet our objectives, build shareholder
value and promote our stakeholders interests. We have a group-wide
risk management process, the four stages of which are shown below.
IdentiƬcation
Business activities
Monitoring Evaluation
Response
Changes over the year
In 201213, we improved the way we manage risk through applying
further scenario planning and war gaming techniques increasing our
assurance over risk management within the lines of business and
refreshing our guidance and risk management toolkit. This year we
madefurther improvements including
Enhanced risk management training
We have signicantly refreshed our risk management training and rolled
this out across the group, reaching a wide audience of colleagues across
26 countries.
Better linkage between our investments and risks
As well as considering risks within investment cases, we have more
formally linked our investments and our principal risks by requesting
thatinvestment case proposals reect any impact they may have on
theserisks.
Proactive assessment of emerging risks
Building on our regular horion scanning, the Group Risk Panel has
commissioned and reviewed specic analysis of emerging risks from a
number of possible future geo-political events. This has improved our
understanding of potential impacts and improved our readiness through
early mitigation and contingency planning.
Line of business and
service unit audit
& risk committees
Line of business and service
unit leadership teams
Our lines of business and our service
unit follow our process for managing
risk as part of our Enterprise Risk
Management framework. That
means identifying and responding
to the key risks to their business.
Theyrecord the risks in a register
for their leadership teams to review.
Audit  risk committees in each line
of business, and our service unit,
ensure this process is eective.
Operating
Committee
The Operating Committee identies,
evaluates, responds to and monitors
risks. Signicant risks are reported
and monitored through the Group
Risk Register. The Operating
Committee
assigns a management
owner to take charge of monitoring
and managing each risk. It monitors
these risks through regular detailed
reviews as well as six-monthly
reviews of the Group Risk Register.
Group Risk
Panel
The Group Risk Panel supports
the Board and the Operating
Committee
. Every three months
it reviews the Group Risk Register
(which summarises those risks of
greatest signicance across our
business), considers the inclusion
of new or emerging risks, and
recommends ways to tackle them. It
also oversees the work of the group
riskmanagement function.
Audit &
Risk Committee
Board
The Board has overall responsibility
for making sure we manage risks
appropriately. It regularly reviews
either directly, or through the Audit
 Risk Committee
, how we are doing
across the group, in our lines of
business and in our service unit.
Enterprise Risk Management framework