Conclusions and recommendations
1. BBC guidance gives both the Executive Board
and the Audit Committee detailed responsibilities for risk management
but they are not clearly delineated.
The BBC Trust, which is responsible for seeing that the Executive
Board addresses the key operating risks for the BBC, should make
it clear that the Executive Board is responsible for the day-to-day
management of risk.
2. The main themes used by the BBC for risk
management are not aligned with its corporate objectives, and
the Executive Board is receiving information on almost 300 risks.
The BBC should align its risk management arrangements with the
strategic priorities to be set by the Trust, and rationalise the
information presented to the Executive Board so that its attention
is focused on the most important risks.
3. The abduction of the BBC journalist Alan
Johnston while working in Gaza illustrates the risks to which
BBC employees can be exposed. The BBC
should update its assessments of the risks of working in hostile
environments. The BBC should also satisfy itself that freelancers,
as well as its employees, are adequately trained for work which
could involve risks to their health and safety.
4. The way the BBC ran a live phone-in competition
on Blue Peter led to Ofcom fining the BBC for failing to comply
with its Broadcasting Code. The BBC subsequently
identified other instances of phone-in and interactive competitions
where the public had been misled. The independent review which
the BBC Trust intends to commission in 2008 will need to identify
the reasons for programme makers ignoring the BBC's own editorial
guidelines and exposing it to significant reputational risks.
5. The BBC has not related its risks to corporate
objectives or assigned all risks to named owners, as recommended
in Treasury guidance. We have commented
before, in our report on the BBC's White City 2 Development, that
the BBC would benefit from drawing on such guidance.[2]
6. BBC managers at all levels are not sufficiently
engaged in the management of risk:
¯ senior
management are not promoting risk management effectively;
¯ individual
risk managers are dissatisfied with the training provided and
do not bother to use the available guidance; and
¯ good
risk management practices are not embedded throughout the BBC's
projects and business processes.
The BBC should develop a timetabled strategy for
increasing and measuring understanding of its risk management
policies and procedures, and require positive confirmation annually
that individual managers understand their responsibilities. It
is helpful that the BBC intends to re-run the National Audit Office
survey of risk management to assess progress.
7. The BBC Trust, not the Comptroller and
Auditor General, decides the programme and the scope of individual
value for money reviews of the BBC. The
Comptroller and Auditor General should have the same rights of
access to the BBC as to other publicly funded bodies. He would
then be able to decide what to examine and when, on the basis
of a full and independent assessment of value for money risks,
and report to Parliament independently of the BBC. There is no
evidence to suggest that such arrangements would do anything other
than strengthen Parliamentary scrutiny of the BBC and the oversight
role of the BBC Trust.
2 Committee of Public Accounts, Twenty-fourth Report
of Session 2005-06, The BBC's White City 2 development,
HC 652 Back
| 
