BT 2016 Annual Report Download - page 42

46 BT Group plc
Annual Report 2016
Our risks
We’re aected by a number of risks and uncertainties.
Some risks come from outside our business, others from
within. Some we can’t control. Many of our risks are similar
to those felt by comparable businesses.
Principal risks and uncertainties
The principal risks and uncertainties that aect us could have an
impact on our business, brand, assets, revenue, profits, liquidity
or capital resources. The principal risks we described last year have
evolved, and so has our response to them.
Our Enterprise Risk Management framework gives reasonable
(but cannot give absolute) assurance that we’ve identified and
addressed our biggest risks. However, there may be some risks
which are unknown to us today. And there may be some that we
consider less significant now but which become more important
later.
Things that happen outside BT present both risks and
opportunities, to our business and to others. We focus our eorts
on predicting and mitigating those risks while aiming to take
advantage of any opportunities that may emerge.
We recognise the particular uncertainty that political and geo‑
political risks present, both in the UK (like the forthcoming
referendum on Britain’s membership of the EU) and globally.
We monitor these through a separate sub‑committee of our
Group Risk Panel.
In the section that follows, we talk about what we’re doing to stop
our main risks materialising, or to limit their impact. Our biggest
risks and uncertainties should be considered alongside the risk
management process, the forward‑looking statements in this
document and the cautionary statement on those statements
(see page 248).
How we manage risk
To meet our objectives, build shareholder value and promote
our stakeholders’ interests, we must manage risk.
We have a group‑wide risk management process with four stages.
The directors believe our Enterprise Risk Management framework
and process support a robust assessment of our principal risks.
Identication
Business activities
Monitoring Evaluation
Response
Changes over the year
In 2014/15 we improved the way we manage risk by:
strengthening our approach to managing it in projects and
programmes; further developing our assessment of risk appetite;
and identifying opportunities to develop our risk management
culture. Specific improvements in 2015/16 included:
UK Corporate Governance Code
Responding to changes in the UK Corporate Governance
Code, we’ve refreshed several aspects of our risk management
framework. That included expanding our quantification
methodology and reviewing our material controls.
Enhanced tools
This year we’ve trialled software which helps with modelling risk.
We’re also in the process of upgrading our core risk management
software to make it easier for people to use.
Education and awareness
We believe risk management is an essential capability for our
business. It’ll therefore be a core skill across all the professions in
our business with tailored training for everyone who works for BT.
Enterprise Risk Management framework
Line of business and
BT TSO audit
& risk committees
Line of business and BT TSO
leadership teams
Our lines of business and BT TSO
follow our process for managing
risk as part of our Enterprise Risk
Management framework. That means
identifying and responding to the key
risks to their business. They record the
risks in a register for their leadership
teams to review. Audit & risk
committees in each line of business,
BT TSO and our group functions,
ensure this process is eective.
Operating
Committee
The Operating Committee identifies,
evaluates, responds to and monitors
risks. Significant risks are reported
and monitored through the Group
Risk Register. The Operating
Committee
assigns a management
owner to take charge of monitoring
and managing each risk. It monitors
risks through regular detailed
reviews as well as six‑monthly
reviews of the Group Risk Register.
Group Risk
Panel
The Group Risk Panel supports
the Board and the Operating
Committee
. Every three months
it reviews the Group Risk Register
(which summarises those risks of
greatest significance across our
business), considers the inclusion
of new or emerging risks, and
recommends ways to tackle them.
It also oversees the work of the
group riskmanagement function.
Geo‑political risks are reviewed by a
sub‑committee of the Panel.
Audit & Risk
Committee
Board
The Board has overall responsibility
for making sure we manage risks
appropriately. It regularly reviews,
either directly or through the Audit
& Risk Committee
, how we’re doing
across the group, in our lines of
business and in BT TSO.