Examination of Witnesses (Questions 20-39)
BBC
WEDNESDAY 6 JUNE
2007
Q20 Mr Wright: That seems to be slightly
at odds with the Treasury's Orange Book in terms of having that
alignment with corporate objectives and risk management.
Mr Peat: Then there is a specific
obligation set out in the protocol that the Trust has consulted
on and published about the role of the Trust with regard again
to receiving periodic Reports, not just on the top five risks,
which we will look at very regularly through our finance and strategy
committee, but also having annual Reports and six-monthly updates
on both the process and on the key risks. So the specific roles
of the Trust, the non-executive directors and audit committee
and the executive and indeed the Chief Risk Officer are very clearly
articulated and set out. In my view that sets out who is managing
what and who is responsible for what in a way that I find very
clear and very helpful.
Q21 Mr Wright: There seems to be
a bit of concern about the risk appetite of the corporation. Are
you happy Mr Peat that you have set the agenda in terms of the
risk appetite that you are prepared to take and the management
need to manage that risk appropriately?
Mr Peat: Yes. We are clearly still
at an early stage in the new governance structure. The non-executive
directors were only appointed this year and also the Trust was
only appointed this year and I am one of only three members of
the Trust who carried on from the old governors. Clearly we are
still settling down in our new system, but yes, the appetite for
risk and the strategy for the BBC are both matters for the Trust
and therefore it flows from that to the executive board and to
the non-executive directors to take the role further.
Mr Thompson: It is just worth
saying about risk appetite that of course the topic of risk appetite
varies very much depending on what you are talking about. Your
appetite for risk in terms of financial control should be, and
is in the case of the BBC, very, very low indeed. If you are investing
in new comedy programmes, you are not going to get great comedy
unless you are prepared to take one or two risks. What is interesting
about risk in the BBC is that you have to take different judgments
about risk appetite depending on what the subject and the decision
in front of you is.
Q22 Mr Wright: May I talk about embedding
risk management into real practice in the BBC? I get the impression
from reading this Report that people do risk management as a sort
of add-on to their normal operations, for example, paragraph 23
states: "While the new arrangements settle in, the Risk Assurance
Team is having to prompt some divisions to update their risk registers".
I suppose this is directed to you Ms Patel. To what extent are
you happy that risk management is part of what people do in terms
of management, rather than just seeing it as an add-on thing and
every quarter: "Oh my God, we have to do this risk register"?
Ms Patel: We have always had risk
management processes. Back in 2005 we conducted a thorough best
practice review on the advice of our external auditors who said
that actually we could get much better at this and make it part
of day-to-day life. The new arrangements we put in place in 2006
were designed to do that. We have used self-assessment to understand
the maturity of it. Are people promoting it and leading it well?
Is it embedded in the process? Let me give you an example of something
that is absolutely embedded in the process: occupational risk,
the safety assessments before we do anything. That is in our DNA
now; it is done as a matter of course. If you take a low-risk
area like marketing, for example, historically they have not had
huge levels of risk and therefore they are less mature in the
way they deal with it. The key area of development for us in the
year ahead is embedding risk management in big complex projects.
We have quite a few of those on the go at the moment and embedding
it there and making sure that the capability and the training
of people identifying and managing those risks is higher than
it is today is a key objective for 2007.
Mr Thompson: If I might refer
you to paragraph 14, in which the NAO note: "The early signs
are that the new processes introduced in early 2006... are making
a difference" 15 out of 16 members of the Executive Direction
Group, which is the executive directors of the BBC: "...thought
that risk management had improved over the last 12 months"
and the NAO's "...review of Executive Direction Group papers
confirmed that the development of the risk management process
had been a regular item on the agenda". Just to reflect on
something the to suggested, we began this process before it became
an NAO topic. We were very clear with the NAO that this was something
we aimed to improve and they were coming in when we were in the
middle of the process of improving something. Even if you look
at the NAO's results, they have evidence of significant improvement
in various ways in which we are handling risk at the moment. We
would hope, and our repeat of the survey will hopefully support
this, that we will achieve further improvements.
Q23 Mr Wright: What I am trying to
get at is that you must have quite a comprehensive management
information system and paragraph 27 states that you are moving
to a new electronic risk database. Does that not reinforce the
perception that as a Corporation executive risk management is
something additional that you do compared with your normal day-to-day
job?
Ms Patel: Historically that was
the case in certain areas, not in others, for example health and
safety, editorial compliance, fair trading, where we have had
a long period of embedding these processes. What we have tried
to do in strengthening the processes, if you are a business manager
in a business unit, is to make them feel as though they are really
helping you drive your business because that is the secret to
success, rather than imposing a process on them that feels meaningless
to them. One of the other reforms, as the executive board discusses
and thinks about the big risks and actions, is to feed back the
tenor of that debate and the actions taken down the chain so people
understand that something is being done about the risks that they
highlight and escalate.
Q24 Mr Wright: Are you happy that
the electronic risk database complements current management information
systems rather than being an expensive add-on?
Ms Patel: Actually it has helped
us hugely in training people in consistency and it has actually
made it easier for people. They are spending more time managing
risk than filling in manual Reports.
Mr Thompson: And sharing information
across the BBC because of common templates. You can share experience
from one part of the BBC to other parts more easily.
Q25 Mr Wright: There is still a lesson
to be learned in terms of consistency which the Report highlights.
Ms Patel: Yes.
Q26 Mr Wright: A question about methodology
and this is probably directed at the NAO. I notice in appendix
one, paragraph 12, the commissioning of PWC (PricewaterhouseCoopers)
to look at this and they consulted a number of organisations.
Why were broadcasting and communication organisations not looked
at to provide a better fit, as it were, with the BBC? Is there
any particular reason why that was not done?
Mr Hawkswell: I would have to
look into that and give you a fully detailed answer. Principally
we went to PricewaterhouseCoopers because we knew they had experience
of a number of organisations where we felt they would be able
to identify examples of good practice. We did it on that basis.
The extent to which PWC explicitly considered broadcasting organisations,
I actually could not say right now.[1]
Q27 Mr Dunne: I am interested, Mr Thompson,
that you said that the culture of the organisation of adopting
a different approach to risk pre-dated the NAO Report. It is funny
how often Reports come to us where a great deal of improvement
has occurred in the year in which a Report has been prepared by
the NAO, so that is a fairly familiar refrain. It appears from
what you have said in your responses so far, that a lot of work
has been done, which is welcome. Both you and Ms Patel referred
to personal security as one of the key aspects of risk that you
are considering. I note from Table 1 on page 7 that that is not
an issue in the top nine risk themes identified in the NAO Report
and in light of the obviously harrowing recent events in Gaza
and the kidnap of Mr Alan Johnston, which we are all horrified
by, as I am sure is everybody in the BBC, can you tell us specifically
what steps you have taken to consider and review personal security
of your personnel operating in dangerous parts of the world and
how that fits within your risk management structure?
Mr Thompson: Yes, I will. I should
say first of all that the topics in table 1 on page 7 are broad
headings and the totality of health and safety fits in within
those projects. It is within business continuity. To say the obvious,
at the moment, when I Report to the Trust on the top five risks
that the BBC currently faces, risk number one is safety of our
people around the world. Firstly, in the existing context I believe
we have a very, very strong system built up over some years of
basically both preparing our people, the people, typically journalists
but not universally journalists, who potentially have to go to
work for the BBC in hazardous environments around the world, with
comprehensive training, training which we believe is as good as
any training in the world; an initial five-day intensive course,
regularly refresher three-day courses. We make very, very careful
assessments before we deploy people into dangerous situations,
of which there are many in the world right now, about the deployment
and we have security and safety experts who continuously assess
the risks.
Q28 Mr Dunne: Do you provide personal
security for correspondents anywhere?
Mr Thompson: In circumstances
where it is appropriate for security reasons we do provide that.
Q29 Mr Dunne: Have you reviewed those
arrangements since Mr Johnston's kidnap?
Mr Thompson: In critical parts
of the world, and there are many critical parts in the Middle
East and I would certainly include Israel and Palestine in particular
and the West Bank and Gaza as critical and very dangerous parts
of the world, these arrangements are under constant review. At
the moment, we do not have a Home Service BBC correspondent deployed
to Gaza and we would not re-deploy a correspondent to Gaza until
we were satisfied it was safe to do so.
The Committee suspended from 4.03pm to
4.11pm for a division in the House.
Q30 Mr Mitchell: I am a bit of a cynic
about all this risk management business. It looks like a madhouse
to me as I read the Report. You have a senior management team
receiving a significant and huge volume of risk information; the
list contains 44 top risks across nine risk themes. Senior management
receives a 70-page Report updated quarterly on another 140 baseline
risks and quarterly Reports on a further 85 top divisional risks.
This is ludicrous. I always thought of the BBC as a "Nervous
Nellie" but this makes you an institutional jelly.
Mr Peat: Mark Thompson and Zarin
Patel explained earlier, but it is worth just trying to start
again. It is a matter of getting the right reporting of risks
to the right people.
Q31 Mr Mitchell: Yes, but to maintain
such a huge list robs it of all credibility.
Mr Peat: Again, that would never
be the reporting that goes to the top body at all times. There
are specific components of that risk register that are relevant
to particular managers and particular directors within the BBC.
The totality looks huge but the bits that pertain to different
parts of the BBC are to be managed within that area.
Mr Williams: When a management question
is asked, it would be helpful if the individual responsible for
management issues replied otherwise we are going to end up with
two replies.
Q32 Mr Mitchell: This must make your
incumbency at Channel 4 a period of simple delight compared with
this harrowing experience.
Mr Thompson: I accept that you
are trying to do two opposite things, one of which is to try to
capture all of the potential risks that you should be monitoring.
At the same time, you are also trying to focus debate and action
around critical risks and a smaller number. I happen to have brought
with me one of the quarterly risk management updates for the executive
board and it is perhaps ten pages. It has a fairly small number
of risks and it is quite possible in a 45-minute debate to go
through these critical risks, get an update, hear about proposed
actions and debate whether what management is proposing to do
is correct or not. The other thing we are trying to do, the big
focus both of the Orange Book and of the NAO itself, is to make
sure that you have a system that works with sufficient security
and consistency, that it works for those areas which perhaps do
not come ... Journalists' safety is front of mind in the BBC the
whole time. We are not going to forgot about that. We are dealing
with all risks at that level.
Q33 Mr Mitchell: You have the job
of simplifying all this to five top risks. What are your five
top risks this month?
Mr Peat: I have them here, the
ones that were Reported to us at finance and strategy: first was
safety of our people; second was strategy delivery; third was
business continuity; fourth was editorial issues given telephony
and other factors; and the fifth was technology and property.
Q34 Mr Mitchell: How much does that
change on a monthly basis? Some of these are very general, are
they not?
Mr Thompson: Yes, but actually
once you go down one level safety of our people relates quite
quickly to the Alan Johnston situation in Gaza. It relates, for
example in the context of this week, to near term, to what extent
the dynamics of safety in Iraq have changed in the light of the
kidnapping last week of some Britons amongst others in Baghdad.
Although they are general headlines, they are very particular.
If you talk, for example, about business continuity, one issue
is that this is a week when the BBC trade unions are considering
a pay offer from the BBC. I very much hope we reach an agreement
on pay, but demonstrably, there could be an impact on business
continuity. These topics may sound like general topics, but they
are all front of mind for me and the reason I mention them is
because they have real issues associated with them.
Q35 Mr Mitchell: Of course. In the
main, these kinds of things blow up on a monthly basis or suddenly
out of the clear blue sky. A couple of years ago, would Alastair
Campbell have been on your list of major risks?
Mr Thompson: I can say with enormous
gratitude that I was not in this particular role a couple of years
ago and therefore cannot answer your question I am afraid.
Q36 Mr Mitchell: Reputational risk.
Mr Thompson: You heard that one
of the reasons that we are looking at editorial issues, compliance
with the BBC's guidelines, is precisely because we have a couple
of instances, the programme Blue Peter, the programme Saturday
Kitchen, where we have had serious mistakes made in the context
of our editorial guidelines. We have a big system in place. Editorial
compliance and the values and standards of the BBC are very important
areas for the BBC. We have extensive systems in place. We had
a couple of failures of the system and we are taking a lot of
actions to make sure that we do the absolute best we can to minimise
the chance of those failures happening again. So that is an example
of an area of inevitable risk, thousands of hours of live programming,
sometimes things will go wrong but what steps do you put in place
and if it turns out, despite the guidelines, that a mistake happened
once because the guidelines were not thoroughly understood, do
you need more training, do you need to make any amendments or
changes to the guidelines and so on? The point of the exercise
is not just to do it as a piece of abstract bureaucracy: it is
to ask whether we need to change what we do, whether we need fresh
actions to make sure that we reduce these risks or, if we have
made mistakes, to learn from them.
Q37 Mr Mitchell: But the Campbell
onslaught which removed both the Director-General and the Chairman
came quite out of the blue and that was something you could not
be prepared for unless you had a permanent category of reputational
risk. It strikes me that the BBC on that occasion was totally
unprepared.
Mr Thompson: What I want to say
is that in the matter of broadcasting and the editorial direction
of the BBC, the nature of what we do, very large numbers of programmes
and continuous delivery of journalism on television, radio and
the web means there are risks. What I would say is that actually
the history of the BBC, the history of our guidelines and the
way in which we delegate authority to quite junior members of
staff in terms of individual editing of programmes and so forth
and the culture we have of thinking hard about our values means
that actually I believe the overall delivery in terms of accuracy
and quality of what we do is very, very high. The system broadly
works, but of course, once every few years there will be big mistakes.
I would say, one, how can you manage this environment so you reduce
the chances of mistakes as much as you can and two, and perhaps
this goes to your point, also so you make sure that when you do
get a mistake that as management, and me as editor-in-chief, but
the management responds effectively and promptly to the mistake.
In the example of Blue Peter, we decided the moment it
came to light we should disclose completely. We recognised immediately
that we had made a serious mistake and we decided to apologise
to the public and in particular to the children and parents who
watch Blue Peter directly and immediately. How you respond
to the mistake is in some ways equally as important as the actual
mistake.
Q38 Mr Mitchell: I agree with what
you said about standards of the BBC, but the answer seems to me
to be that you should have more confidence in yourself and this
kind of obsession with specified lists of risks must make for
a culture of nervousness which is actually undermining confidence.
Mr Thompson: Honestly, Mr Mitchell,
I am not sure that is true. An environment where, of course we
try to make it as unbureaucratic as possible, because it will
not embed fully in management practice if it feels a very onerous
exceptional task and it needs to be part of the way people work.
I would say in many of the areas we have talked about, safety
of our journalists, the way in which editorial guidance works,
that actually, if you have a good strong system in place, increases
peoples confidence and in areas where we say our appetite is to
take some risk, for example in some of the programmes we commission,
being clear about that again gives people more confidence.
Q39 Mr Mitchell: I found two things
in the Report somewhat contradictory. It says that one third of
the staff surveyed were not clear about when to escalate risk
information upwards. I am surprised at that because it contrasts
with the other point in the Report that there was a culture of
blame. It struck me, working for the BBC, that working for ITV
was almost like being on a pirate ship and you just obeyed the
captain or you were pushed overboard, whereas with the BBC you
were working for a bureaucracy which pushed just about everything
upwards. You had an alphabetical list of names which said that
the presenter of this programme was an idiot or a drunk or whatever
and there was this enormous culture of referring everything upwards
so that nobody could give you a clear opinion.
Mr Thompson: Pushing people overboard
would raise serious health and safety issues for a start.
Ms Patel: A third of people feeling
that they are not clear about whom to escalate it up to is an
issue for us and we have spent time since this came to light in
the survey making sure that people understand that what the Chief
Risk Officer is there to do is to promote the process, to make
sure their divisional boards are actively considering risk so
that people know who to escalate the thing up to. That is important.
The point about blame culture is that it really is not one I recognise.
There has been no instance where a risk has gone unreported and
has become an issue. It is also an organisation that actually
tries to learn from its mistakes. Again the Blue Peter
example is a good one. Why did it happen? We try really openly
to learn that and make sure we fix things quickly. As an organisation—and
I see that the editor of our in-house newspaper is here—we
have a really open system of internal newspapers where people
raise anything. We also have an anonymous whistle-blowing line.
So there is a culture of people being able to say things.
1 Note by witness: Our brief to PricewaterhouseCoopers,
the consultants we appointed to help us in this area, was to use
case examples to illustrate key principles that enable organisations
to identify and respond to risk successfully. We advised the consultants
that it would be desirable to include at least one organisation
from the media or broadcasting sector. There were difficulties
however in encouraging organisations in a competitive broadcasting
market to reveal their risk management practices for the benefit
of the BBC. The organisations cited in our Report did therefore
not include other broadcasters or media companies. As the focus
of our value for money review was the adequacy of the BBC's overall
framework for risk management, we were still able to identify
effective risk management principles for the BBC. Back
| 
