1 The adequacy of reporting on risk
1. In January 2007 the BBC published a protocol setting
the arrangement for BBC Trust oversight of the BBC's risk management
processes. The Trust is responsible for seeing that the BBC's
management's Executive Board addresses the key operating risks
for the BBC, and the Executive Board (through its Audit Committee)
reviews and is "responsible for the BBC's detailed risk management
processes". The protocol also states, however, that the Audit
Committee itself, which comprises non-executive directors, is
"responsible for the day-to-day management of BBC risk management
processes".[3]
2. The BBC produces large volumes of risk information,
having identified 850 individual risks, and almost 300 risks were
being reported to BBC senior management in one form or another
and at different times (Figure 1). The annual baseline
report to senior management, with some 140 risks, was 70 pages
long. The BBC explained that because its operations were complex,
it had identified a large number of risks, but that it tried to
focus debate around a smaller number of critical risks and the
actions to address them.[4]
Figure 1: Risk information received by BBC senior management
| RISK REPORT
| REPORTING/UPDATING CYCLE
|
| 85 top divisional risks
| Quarterly
|
| 140 baseline risks
| Annual (with quarterly updates)
|
| Top 44 risks (under 9 themes)
| Annual (with six month update)
|
| Top 5 risks
| Monthly
|
Source: C&AG's Report, paras 10, 29 and figure
3
3. Treasury guidance is that risks should be related
to corporate objectives and managed in a way which supports the
delivery of those objectives. The Board of Governors was replaced
by the BBC Trust in January 2007, and in place of objectives,
the Trust was in the process of setting strategic priorities.[5]
There was no read across, however, between the objectives set
for management by the BBC Governors and the BBC's nine top risk
themes (Figure 2).
Figure 2: The five areas where the BBC Governors set objectives for 2006/07 do not correspond with the nine top risk themes identified by BBC senior management
| THE FIVE AREAS WHERE THE BBC GOVERNORS SET OBJECTIVES FOR 2006/07
| | THE BBC'S TOP RISK THEMES
|
| 1. Programme strategy
2. Driving digital
3. Value for money
4. Impartiality
5. Accountability
| | ● Business continuity
● Financial management and controls
● Licence fee collection
● Loss of rights of failure to obtain or exploit rights
● Failure to comply with legal and external regulations
● Licence fee settlement
● Loss of competitive advantage
● The Change programme
● Supply chain management
|
Source: C&AG's report figure 1; BBC Annual
Report and Accounts 2006-07, Trust report, p15
4. Treasury guidance is also that all risks should
be assigned to owners, who are responsible for ensuring that the
risks are managed and monitored over time. Almost 250 (29%) of
the 850 risks in the BBC's risk registers had no identified owners.
The BBC accepted this finding and confirmed that every risk and
every action now had an owner.[6]
5. In addition to the BBC's internal risk reporting
framework, arrangements are in place to provide the BBC Trust
with external reviews of value for money from the Comptroller
and Auditor General. The arrangements, agreed between the BBC
and the Government, have given the BBC value for money reports
undertaken by the Comptroller and Auditor General on topics approved
by the Governors' Audit Committee. With the creation of the BBC
Trust, which replaced the Board of Governors, new arrangements
have been introduced which provide for the greater involvement
of the Comptroller and Auditor General in discussions about suitable
topics, but the Trust retains the final say on what is and is
not included in the programme of reviews.[7]
6. We explored how the BBC managed risk in the context
of its recruitment, in particular the extent to which its recruitment
reflected the population it served. The BBC confirmed that it
tracked gender, ethnicity and disability, but had not collected
information on the proportion of its most recent graduate intake
which had attended Oxford or Cambridge and public schools. The
position regarding the Executive Board was, however, that of the
fifteen members (including five non-executives), six attended
independent schools, five attended comprehensive schools and four
attended grammar schools, while six had attended university at
either Oxford or Cambridge.[8]
3 Qq 9, 19-20; BBC protocol C3 - Trust oversight
of BBC risk management processes and internal controls, January
2007 Back
4
Qq 7, 10, 30-32; C&AG's Report, paras 10, 39 Back
5
Qq 18-20; C&AG's report, Figure 1; BBC Annual report and Accounts
2006-07 Back
6
Q 12; C&AG Report, para 39 Back
7
Qq 2-7 Back
8
Qq 57-63 Back
| 
