BT 2016 Annual Report Download - page 50

54 BT Group plc
Annual Report 2016
Wherever we do business around the world, we put in place policies
and programmes to make sure we stick to our own standards and
that those standards meet or exceed minimum legal requirements.
Advice is provided to help management teams understand and
control health and safety risks and help everyone feel involved
in health, safety and wellbeing. We’ve created interventions to
help promote good mental health and physical wellbeing. We
also provide support and rehabilitation services for people who
have mental or physical health issues. And we complement these
measures with strong attendance management processes.
Privacy by design is about building privacy into products and services.
It helps organisations understand their privacy and data protection
obligations. It also indicates a positive data compliance culture. The way
we do privacy by design is through our Privacy Impact Assessment tool.
How we managed the risk
This year, we took a phased approach to embedding Privacy Impact
Assessments within our various lines of business, starting with BT
Consumer.
At the heart of our process is an online tool which each new product or
service proposition must go through. It identifies what the proposition
involves, what personal data is in scope and whether third parties will
access that data. It also asks other tailored questions around marketing,
big data analytics and customer communications. All that provides an
initial insight into the risks.
Our privacy team follow this with an extra one-to-one review for more
complex propositions. They must formally sign them off before they can
move forward and get further development funding. This means our
Privacy Impact Assessment process must be quick to make sure we can
move fast to exploit commercial opportunities.
The result, and what we learned
From small system changes (for example in marketing) to large-scale
projects (like our SmartTalk app) we’ve created Privacy Impact Assessments
in line with industry best practice.
The Privacy team has had to learn to prioritise how they review Privacy
Impact Assessments to meet launch timescales. The tool itself has been
through various versions to make sure it meets the needs of people using
it, with stage gates speeding up the flow of approval and sign off.
It’s likely we’ll need extra changes as we move to confirming the EU
General Data Protection Regulation and what that’ll mean for our
business. But the Privacy Impact Assessment tool’s flexibility will let
us do that with minimal impact on the business.
Case study: Privacy by design
Our viability statement
Assessment of prospects
An understanding of the group’s business model and strategy
are central to assessing its prospects, and details can be found
on pages 21 to 30.
Our business model provides resilience that is relevant to any
consideration of our prospects and viability. We have a broad
spread of customers and suppliers across different geographic
areas and market sectors, serving the needs of customers
across 180 countries worldwide. In the UK, we benefit from
diversification across a number of markets and products, which
has increased in recent years, most notably through the launch
of BT Sport and the acquisition of EE.
Our strategy of delivering superior customer service, transforming
our cost base and investing for growth are all designed to support
long term and sustainable cash flow growth.
We assess our prospects on a regular basis through our financial
planning process. Our three-year Medium Term Plan forecasts
the group’s profitability, cash flows and funding requirements.
The Medium Term Plan is reviewed by the Board twice during
the year and the latest refresh includes forecasts related to our
newly-acquired EE business. The Medium Term Plan is built
from the ‘bottom up’ forecasts of each of our lines of business,
supplemented by items managed at a group level and assumptions
such as macro-economic activity and exchange rates. The
performance of the group and our lines of business against these
forecasts is monitored monthly and this is supplemented each
quarter through a series of ‘deep dive’ Business Unit Reviews
performed by the
Operating Committee .
Viability statement
In accordance with provision C2.2 of the 2014 revision of the
UK Corporate Governance Code, the directors have assessed the
prospects and viability of the group.
Although the directors have no reason to believe that the group will
not be viable over a longer period, the Board has chosen to conduct
this review for a period of three years to 31 March 2019. The
Board believes this is an appropriate timeframe as it aligns with the
group’s financial planning processes.
In support of this statement, we have stress tested our forecast
cash flows by assessing the potential combined impact our most
significant risks could have on these forecasts. This assessment
was informed by our judgements as to the potential financial
impact of these risks if they materialise, together with their
likelihood of occurrence.
Our stress testing confirmed that in many of the scenarios tested,
existing projected cashflows and cash management activities
provide us with a buffer against the impact of these risks. In the
most extreme scenarios we tested, where all of our principal
risks are assumed to materialise over the three-year period,
we have considered the further actions we could take to mitigate
the negative cash flow impact and generate additional funding.
These actions could include, for example, sale of assets, limiting or
delaying discretionary capital expenditure and marketing activities,
restricting share buy back programmes and reducing or ceasing
dividend payments.
In our viability assessment we’ve adopted a number of assumptions
designed to stress test our resilience. For example, in making our
assessments of the impact and likelihood of our risks, we’ve only
taken into account the control activities that we have in place today.
We’ve not factored in any of the extensive future mitigation activity
that we’re undertaking to address these risks, thereby assuming
such activity proves ineffective. We’ve also assumed that existing
debt facilities which mature over the three-year period will not be
renewed. While we don’t expect this to happen, we’ve adopted
these pessimistic assumptions to add greater stress to our viability
testing.
Based on the results of this analysis, the directors have a reasonable
expectation that the group will be able to continue in operation
and meet its liabilities as they fall due over the three-year period of
their assessment.