Our principal risks

We manage risk by establishing a structured risk framework, clear standards, and defined accountabilities to ensure effective identification and management of risks across the business. These standards define our risk appetite, outline the responsibilities of management teams, and the structure of our risk governance. This is all reflected in the way we manage risks in line with our risk management framework as outlined below.

1. How we manage risk

Our approach to risk management helps to ensure that risks are identified, assessed, managed and monitored appropriately in line with our risk framework as outlined below:

Our risk framework

We have a four-step process to support the business to manage risks within our day-to-day activities.

Risk Governance: Oversight provided by the BBC Board and the Audit and Risk Committee (ARC), Management oversight provided by Executive Committee and Operations Committee.

1. Identify

• Risks are identified in line with our corporate risk taxonomy and assessed by the Operations Committee with input from the Executive Committee. Risk owners are assigned to each risk at an appropriate level.
• The Board and ARC provide input during the review of principal risks.
• Divisional level risks are identified based on consideration of factors with the largest potential to impact Divisional strategy and objectives.
• Emerging risks are identified via scanning of upcoming areas of interest, threats and opportunities with subject matter expert teams.

2. Analyse

• We analyse the likelihood of each identified risk crystallising given mitigations in place.
• We assess the potential impact of financial, reputational, legal and regulatory, operational and health and safety considerations.
• Collectively this analysis allows us to determine whether additional mitigation is needed given our risk appetite.

3. Manage

We use a three lines of defence model to manage risks:

• Risk owners in the Divisions and functions manage risk and ensure the effective operation of mitigations and controls.
• Risk appetite statements and risk metrics are in place for key operational risk areas. Our risk appetite approach sets both current and target (aspirational) state. Management actions in place to bring current risk appetites to target. Actions are tracked to completion.
• The Corporate Risk Management team monitors risks, including whether risks are in or out of appetite.
• Audit and Assurance provides independent assurance on key business risks, as appropriate and based on their audit plan.

4. Monitor and report

• The Operations Committee, which is a sub-committee of the Executive Committee, has delegated authority to monitor key operational, risk, compliance and project-related activities. This includes the improvement of internal controls, overseeing remedial activities, and conducting deep dives on specific risks.
• The Executive Committee receives a quarterly risk dashboard; the Director-General receives a monthly operational performance briefing; Operations Committee receives a monthly dashboard.
• The remit of ARC is to review and maintain oversight of BBC Group’s internal control and risk management processes, particularly with respect to financial reporting and the key operational risks facing the Corporation. ARC receives a quarterly risk report covering key operational, compliance, emerging risk areas including progress and performance against metrics and targets. Risk deep dives are conducted into specific areas as required.
• The Board provides oversight of strategic risks, whilst the BBC Executive Committee is responsible for the management of strategic risks. The Board receives a quarterly risk update report on key operational, and compliance risks.
• Divisions and functions maintain local risk registers which are reviewed and approved at Divisional governance committees.

Risk management at the BBC in 2025/26

Effective risk management is integral to the BBC’s success, ensuring that we navigate uncertainties whilst protecting our reputation and value to audiences.

The risk landscape in 2025/26 has continued to evolve at pace, against a backdrop of geopolitical volatility, global conflict, a shifting macroeconomic environment, and heightened cybersecurity threats.

The media market continues to go through a period of unprecedented change, with audience behaviour evolving rapidly, distribution moving to streaming platforms including video sharing platforms (VSPs), and increased pressure on funding for both commercial and public service broadcasters.

The safety and security of our staff and journalists supporting newsgathering operations in a high volume of active global conflict zones has been one of our highest priorities during the year. Coupled to this, we have seen a sustained increase in protest activity across the UK and a challenging operating environment, resulting in heightened risks to our people and premises. Significant activity has been undertaken to enhance protective measures across BBC sites.

Reputationally, a series of high-profile incidents have adversely impacted public perceptions of the BBC’s impartiality and have resulted in changes to senior leadership.

The BBC undoubtedly faces financial challenges, reflecting both the uncertainty of the current funding model and wider cost-base pressures. As negotiations for the new Charter begin, defining a funding model that reconciles delivery of the BBC’s strategic objectives with the most rapid and disruptive transformation to the media market in generations, is one of the key uncertainties.

The BBC is a vital national asset and is needed more than ever. But it is also at risk like never before. To achieve the modern, agile and financially sustainable BBC of the future, and to achieve our strategic ambition, we must fundamentally reshape the way in which we operate

UK Financial Reporting Council (UK-FRC) Corporate Governance Code Requirements - Provision 29:

In 2025/26, a key focus has been implementation and embedding of the revised UK Corporate Governance Code which will include in 2027 a new directors’ declaration addressing material risk management and internal controls. This requirement applies to financial periods starting on or after 1 January 2026.

Our approach is centred on our Material Risks which may threaten the business model, future performance, solvency, liquidity and reputation of the BBC. We are strengthening our existing risk management processes and controls for operational risks as well as internal controls over financial reporting risks. We will continue to monitor progress in implementing our internal controls framework and keep our priorities under review.

Our approach to risk management and internal control implementation is built on a three-tier risk hierarchy enabling proportionate management and oversight of risks at the different levels of the business.

i. Material Risks: Material Risks represent those risks that could pose an ‘existential level’ threat to the BBC’s performance, solvency or reputation. The Executive Committee and Board has agreed a set of 12 Material Risks which are managed by the Executive Committee and overseen by the Board and its sub-committees – including the Audit and Risk Committee. The 12 Material Risks in 2025/26 encompassed seven risk areas i.e. audiences; editorial; funding; technology; supply chain; staff safety and security risks and financial reporting risk. Full details are outlined in section 2: our principal risks.

ii. Other Priority Risks: Other Priority Risks are risks of significant organisational importance that could result in major disruption but do not meet the threshold of Material Risks. These risks are reviewed across the full corporate risk taxonomy and are governed and overseen by the Operations Committee, with bi-annual review and approval. Other Priority Risks monitored and overseen by Operations Committee in 2025/26 included: compliance with international laws and regulations, data protection, transformation risk and environment sustainability risk.

iii. Divisional or Functional Risks: Divisional and Functional Risks are identified and managed locally by divisions and functions and are overseen through divisional governance arrangements. These risks may be escalated to Group level where appropriate.

Risk Governance and Oversight:

i. Material Risk ARC Reporting: 2025/26 saw the Material Risk framework embedded, with Audit and Risk Committee reporting fully aligned to the BBC’s 12 Material and Other Priority risks, supported by the development of metrics.

ii. Material Risk and Control testing: Following identification and agreement of Material Risks and Material Controls, dry run testing of control design and effectiveness is in progress, with independent testing and validation conducted by Internal Audit.

iii. Risk Action Tracking: A process to formally track and monitor risk actions was implemented in 2025/26, encouraging active management of risk. The processes has enabled actions to be monitored in a timely manner, and has assigned clear accountabilities for delivery, providing management with early visibility of implementation delays / challenges and supporting stronger governance and risk outcomes.

iv. Risk Deep Dives and Risk Appetite Deep Dives: During 2025/26, a structured programme of in-depth risk discussions was undertaken, incorporating both risk deep dives and rolling annual risk appetite reviews. Risk owners presented the risk outlook, current status, and mitigation activities, with discussions covering key operational risks including Cyber Security, Data Protection, Corporate Security, Safety, Sustainability, Financial Reporting, Fraud and Anti-Bribery and Key Supplier Failure.

These sessions enabled a comprehensive review and refresh of risk appetite, integrated into the broader assessment of operational risks. Risk appetites, associated metrics, targets, and management actions were reviewed, challenged, and overseen by the Audit and Risk Committee (ARC) as part of its governance responsibilities. ARC continued to evaluate the overall risk profile, monitor the timeliness of remedial actions, and assess management’s approach to risk mitigation.

In addition, the Operations Committee considered significant change and transformation initiatives, including East Bank BBC Music Studios and orchestras building and the TV Licensing website upgrade. A dedicated session for ARC members on technology resilience and cyber risk was also held. For further detail on ARC deep dives, please refer to the Audit and Risk Committee report.

v. Corporate risk taxonomy: The taxonomy remains the cornerstone of our risk framework that enables the completeness of risk identification, risk aggregation, and ensuring that risk reporting remains consistent.

vi. Corporate Policy Refresh: A project to refresh our Corporate Policies was completed with the launch of 30 new policies in July 2025, providing a more streamlined and consistent approach.

vii. Second line assurance activity: our established programme of second line assurance activity covering areas including Safety; Safeguarding; Data Protection continues to drive pan-BBC remedial activities and improvements to the control environment.

viii. Third line assurance activity: Internal Audit presented 36 completed audits to ARC in 2025/26. The plan for each year focuses on the BBC’s highest-risk areas, providing independent pan-Group assurance, strengthening controls, driving accountability and improvement, and supporting effective risk management and governance.

Priorities for 2026/27:

i. UK Corporate Governance Code implementation: 2026/27 will be the first full year in which the proposed Board Declaration over Material Controls will be required. During 2026/27, we will validate our Material Risks and Controls with the Executive Committee, confirming that they remain relevant for the reporting year, and will undertake management testing. Internal Audit will conduct independent Line 3 testing over the risk management and internal control frameworks and operating effectiveness of financial and operational controls. We remain on track to enable the Board to make its first attestation for financial year end 2026/27.

ii. Strategic risks and targets: Given the unique nature of our strategic risks which are significantly impacted by external factors, our mitigation efforts are concentrated on areas within our direct control or influence. We therefore plan to utilise targets and tolerances set for our Strategic choices in line with our Group scorecard to monitor the performance of strategic risks for risk appetite purposes.

iii. Operational risk appetite programme: We will continue to embed and monitor our operational risk appetite programme.

Emerging risks

Emerging risks are unforeseen threats which may develop or those which already exist but whose impacts are difficult to quantify. They are considered over short-, medium- and longer-term timeframes.

Emerging risks are categorised into external or market facing, political, legal and regulatory, operational and technology. Such risks are monitored and tracked through our existing risk framework. The following emerging risks are being considered for the forthcoming year:

i. Geopolitical risks: The BBC operates in a dynamic geopolitical setting, with factors such as hard power resurgence, growing use of geo-economic coercion and rapidly expanding AI‑enabled cyber activity and the AI-driven lowering of high‑impact digital disruption barriers, expected to shape the 2026 environment.

ii. AI Cyber Criminality: The growing use of artificial intelligence by criminals to carry out more sophisticated and scalable cybercrime, with AI making it easier for attackers to automate hacking, generate convincing scams, identify system weaknesses, and analyse stolen data at speed. Even when criminals cannot immediately exploit stolen information, data can be stored in the expectation that future AI tools will make it easier to unlock, combine, or monetise. As AI capabilities evolve faster than traditional security controls, the gap between attackers and defenders will widen. There is a growing risk that today’s security measures may not be sufficient against tomorrow’s AI‑enabled attacks, particularly for sensitive data and critical services, making early action and long‑term resilience essential.

iii. UK Social media for under 16s: In 2025, the UK Government announced plans for restrictions on the use of social media by under 16s. Whilst the breadth and coverage of this is yet to take full shape, the BBC is monitoring developments and potential impacts on our content and audience proposition.

Key Legislative changes:

i. Cyber Security Bill: is likely to come into force in 2026, setting out requirements for baseline cyber risk management obligations, expanded incident reporting and supply chain assurance alongside enhanced Regulator powers, including higher fines for non-compliance and strengthened enforcement arrangements.

ii. Employment Rights Act 2025: whilst already enacted, certain elements come into force during 2026/27. Our HR teams continue to monitor and assess each element that is applicable to us and implement across the organisation.

Assessing the effectiveness of risk management and internal control

The Board, supported by the Audit and Risk Committee (ARC) and the Board’s other sub-committees, monitor and oversee the effectiveness of the BBC’s Risk Management and Internal Control framework. The ARC receives management reporting; quarterly reports on risk management and compliance as outlined above; the results of internal audit assurance; and conducts focussed deep dives on specific areas of risk to help make an assessment on the effectiveness of risk management and internal control.

2. Our principal risks

An assessment of the principal risks facing the Group, including those that would threaten its business model, solvency and liquidity, future performance and reputation was undertaken by the Executive Committee and overseen by the Audit and Risk Committee in January 2025. These risks continued to be overseen by the Audit and Risk Committee during 2025/26.

The impact of these risks is considered when developing the BBC’s viability statement. The principal risks and uncertainties faced by the Group are set out below.

During the course of 2025/26, we refined our risks as our operating environment shifted. Mis-information risk is now considered a sub-risk of impartiality and editorial standards risk and is therefore not a standalone principal risk. We will continue to review and validate our risks for 2026/27.

Audience

1. Inability to maintain a critical mass of high-quality content.

2. Inability to grow online destinations of scale to meet the changing needs of our audiences.

3. Inability to maintain universal, easy to access distribution with significant prominence and appropriate value return.

Funding

4. Significant reduction in income to fund public service activities from Licence fee collection, BBCC (profits and dividend) and or Government funding (Grants in Aid) received by BBC.

5. Insufficient financial resources to deliver the strategy.

Editorial

6. BBC is not perceived as an impartial, accurate and trusted provider of news and content.

7. Material breach of BBC Editorial Standards resulting in sanctions and/or fines, as well as reputational damage.

Technology

8. Failure of a critical broadcast, online and/or operational technology resulting in significant disruption to operations, negatively impacting staff and/or audiences.

9. Significant cyber-attack resulting in substantial loss or theft of sensitive BBC data or a significant, prolonged period of outage.

Supply Chain

10. Failure of a key supplier, resulting in material disruption to operations with significant audience and/or staff impact.

Staff safety / security

11. Failure to ensure the safety, security and welfare of individuals to whom we owe a duty of care, causing serious harm to both the individual and the BBC's reputation.

Financial reporting

12. Financial Reporting Risk - Material Financial Reporting Misstatement.