Audit and Risk Committee report

Summary

I am pleased to present the Audit and Risk Committee’s annual report for 2025/26.

The Committee met five times during the year and provided independent oversight of key elements of the BBC’s controls framework, with particular focus on financial reporting, internal controls, internal audit and risk management. During the year, I was supported by fellow Board members Michael Plaut and, until his resignation in November 2025, Shumeet Banerji. This report outlines the Committee’s principal areas of activity and the assurance we sought and received from management as well as internal and external auditors throughout the year.

Annual Report and Accounts: The BBC’s Annual Report and Accounts for 2025/26 were reviewed by the Committee and recommended for approval to the Board. In doing so, we challenged management constructively on key judgements, estimates and disclosures, and assessed whether the accounts, taken as a whole, are fair, balanced and understandable. The National Audit Office’s (NAO) report which supported their unqualified opinion was carefully considered.

Oversight of external auditors: We oversaw the BBC’s relationship with the NAO on behalf of the Comptroller and Auditor General in his capacity as our statutory external auditor. This included reviewing their audit plan, their assessment of audit risk, completion of their audit and related conclusions. Implementation of recommendations to management arising from the NAO’s prior year work was also monitored.

Effectiveness of Internal Controls and Risk Management: We reviewed the effectiveness of the BBC’s systems of risk management and the internal control framework on behalf of the Board. This work was informed by findings from Internal Audit and Assurance activity, and quarterly risk reports focused on the BBC’s material risks. We also received updates on the status of the BBC’s preparations for the 2027 Board declaration on the effectiveness of material controls.

Trading and Separation: The Committee determined that a more robust level of assurance was desirable in respect of Ofcom’s Trading and Separation compliance arrangements (also known as Fair Trading) and, during the year, moved from a limited external assurance approach to a more in-depth review undertaken by Internal Audit. This included observations on control design and operation, and insights on where enhancements could strengthen processes to support the assessment of the adequacy of current arrangements.

Internal Audit: We approved the annual Internal Audit plan and reviewed the resulting audit reports, including Internal Audit’s annual assessment of controls. During the year, we oversaw the successful implementation of improvements to strengthen the Internal Audit function, including embedding PwC’s external quality assessment recommendations and introducing a revised operating model that reduces reliance on third-party providers and increases in-house capability.

Major projects: We monitored the status of the BBC’s Transformation Portfolio and major programmes, with particular focus on the progress of the East Bank BBC Music Studios and orchestras building and the TV Licensing website upgrade.

Whistleblowing: Reports detailing the volume and trends of whistleblowing allegations were considered by the Committee in private sessions, to maintain confidentiality.

Cyber and Technology: A regular cadence of reports on cyber and technology resilience risks were included on the Committee’s agenda during the year, including the changing threat environment, recent incidents and progress against key control improvements. We discussed risks relating to ransomware, third-party suppliers, data protection and insider threat, as well as the increasing use of new technologies such as artificial intelligence.

In addition, the Committee’s agenda continued to evolve to reflect priority matters within its remit and management’s responses to emerging issues. We maintained a strong focus on how organisational culture shapes risk and control, supported by Internal Audit’s insights on management’s risk awareness and culture-related assurance work. Reviews of bullying and harassment cases, complaint investigations, and deep dives into key risk themes were also presented.

Committee role, meetings and membership

The Committee meets at key points throughout the year to ensure we have timely oversight to discharge our responsibilities. The remit is defined within the Audit and Risk Committee’s Terms of Reference, last reviewed and approved by the Board in 2024. Minutes from meetings are made available to the Board, and the terms of reference and summary minutes are published on the BBC website.

As Chair of the ARC, I report to the Board after each meeting, highlighting key matters considered and any areas requiring action or improvement. The Committee and I also meet privately with Internal Audit and the external auditors at appropriate points during the year, without management present.

The members who served during the 2025/26 financial year were:

• Chris Jones (Committee Chair)
• Michael Plaut
• Shumeet Banerji (resigned November 2025)

I have significant, recent and relevant financial experience, as required under the Committee’s terms of reference and the Combined Code, and all members who served with me during the year brought the skills and experience necessary to discharge our duties. Where appropriate, our capability is supplemented by input from internal and external specialists.

The Director-General, the Group Chief Operating Officer, the Group Chief Financial Officer and the Director of Quality, Risk and Assurance attend meetings, along with senior representatives from Internal Audit, Risk Management and the NAO. A non-executive Director of the BBC Commercial Board normally attends as an observer.

Annual Report and Accounts

During the year the Committee reviewed the financial statements of the BBC. In doing so, we:

• considered the going concern and viability statements;
• discussed and challenged management on financial reporting risks, including areas involving significant judgement and estimates, and concurred with management’s views;
• considered the risk of material misstatement due to fraud and error;
• assessed whether the accounts are fair, balanced and understandable;
• sought assurance on compliance with IFRS and the UK Corporate Governance Code, including explanations for any exceptions; and
• reviewed and challenged the regularity of the reported accounts.

Management confirmed that they were not aware of any misstatements made intentionally or in error to achieve a particular presentation.

Wider Annual Report: We also reviewed how the Group financial statements are positioned within the wider annual report, supported by reports from management, Internal Audit and the external auditors covering accounting policies, compliance with accounting standards, the UK Corporate Governance Code and other legal and regulatory requirements, disclosures, data accuracy and overall reliability of the report.

We were satisfied that the financial statements reflect the significant judgements and key estimates both in respect to the amounts reported and related disclosures, and we recommended the accounts to the Board for approval.

Key areas of judgement considered included:

Income Recognition

We were updated on the most significant contracts and the associated mitigation controls. Management confirmed ongoing training, regular reviews of material revenue contracts, and that all new contracts are assessed under IFRS 15 - Revenue from Contracts with Customers. No significant changes to commercial revenue contracts occurred during the year.

Pension and Actuarial Assumptions

We noted the use of independent experts and the use of sensitivity and scenario analysis to determine the most appropriate assumptions. Reporting was provided to us on pension scheme matters including key assumptions, judgements and estimates; in addition, we carried out a deeper dive into pensions matters.

Leases

The complex nature of the BBC’s properties and the contractual conditions of lease arrangements require judgement under IFRS 16 – Leases. We were satisfied that treatment of property leases within the financial statements was consistent with management’s intentions and contractual terms.

Cash Flow Swaps

Cash flow fixing swaps change the BBC’s inflation-linked rental payments for London Broadcasting House (LBH) into a flatter cash flow profile through to 2045. We were briefed on the assumptions used to calculate their fair value and noted that the model is reviewed annually by the Head of Group Treasury.

Consolidation

Management confirmed that detailed reviews are provided over consolidation models and areas of judgement. All new entities are assessed to determine how they should be accounted for. 

We noted that management performs re-assessments of control where changes in circumstances indicate that control may have arisen or altered, ensuring each entity
is appropriately reflected within the Group consolidation.

We gave particular attention during the year to the assessment of control over Daunus Limited, a joint venture set up in 2003 to refinance the BBC’s LBH property, due to the complexity of its structure. Deep-dive sessions were held to enhance the Committee’s understanding of the associated consolidation considerations. Management obtained independent third-party advice to support the accounting assessment, and we recognised both the depth of analysis undertaken and the significant level of judgement required.

Internal Control over Financial Reporting

The Committee received quarterly updates in relation to the multi-year programme to enhance controls over financial reporting. We noted that significant progress continues to be made in enhancing the BBC’s material controls framework, with elements of the framework continuing to mature. We will continue to monitor progress during the 2026/27 financial year.

Cash Flow Statement

Management shared with the Committee a new process for preparing the cash flow statement which was introduced during the year. This enhanced approach places clearer ownership and accountability for the underlying inputs with the relevant business areas.

Provisions and Contingent Liabilities

We reviewed reports on potential liabilities and discussed the level of provisions where appropriate with management. Management confirmed that they have applied a consistent approach to the identification, recognition, and release of provisions across the BBC Group, and we were satisfied with the level of provisions carried and the disclosure in respect of those provisions.

Oversight of External Auditors

Under the 2016 Royal Charter and Agreement, the Comptroller and Auditor General, and thereby the NAO of which he is head, is appointed the BBC’s statutory auditor for the duration of the Charter period.

We oversaw the relationship with the NAO as statutory auditor, including the scope and independence of their work. Areas of focus included:

• implementation of prior year recommendations;
• review of audit effectiveness and performance;
• the external audit process, including regularity and propriety reporting;
• the NAO’s assessment of audit risks or judgements; and
• the quality of the audit including the auditor’s completion report, audit findings and management letter.

We noted the positive working relationship between the NAO and management. A review of the effectiveness of the external audit for 2024/25 was presented and found that the year-end process was smoother than in the prior year, reflecting enhanced BBC management processes as well as better collaboration and clearer communication.

The NAO undertakes value for money reviews and audits the Licence Fee Trust Statement on behalf of Parliament. It does not provide non-audit services, and these would not be considered. Recruitment from the NAO into any senior management position in the BBC would require the prior approval from the ARC.

Effectiveness of Internal Controls

The Committee reviewed the effectiveness of risk management and internal controls on behalf of the Board, drawing on assurance activity and management reporting. Areas we considered included:

• attestations from the Board and Executive Committee members;
• Internal Audit themes and findings, and the effectiveness of Management’s closure of associated actions;
• quarterly risk reports. We noted the transition of risk reporting to Material risks and challenged management on risks with exposures or trending outside of appetite and actions to remediate these;
• incident management;
• deep-dives on key risks included cyber risk, as well as broader IT resilience, financial reporting, and whistleblowing which are regular agenda items. Risk appetite deep-dives discussed in detail included Data Protection, Corporate Security, Safety, Sustainability, and Key Supplier Risk Management;
• mechanisms in place to detect and prevent incidents of wrong-doing, including whistleblowing; and
• progress on critical projects.

We received regular updates from Management on the progress being made to enhance the BBC’s material controls framework, in preparation for the 2027 Board declaration on the effectiveness of material controls. Specifically, the Committee received reports on the BBC’s material risks, the progress on defining associated material controls and the approach to assurance and reporting.

For further detail on BBC risks, see the Principal Risks report.

Trading and Separation

The Committee oversees the BBC’s compliance with Ofcom’s Trading and Separation regulation and provides assurance to the Board on governance and risk management in this area.

Our oversight includes monitoring risks, reviewing compliance of the BBC’s commercial activities, overseeing training and awareness, ensuring independent assurance, and reviewing compliance with Ofcom’s reporting requirements.

Internal Audit undertakes a review of these arrangements and will provide its findings and recommendations to the Committee. This was the first year of Internal Audit delivering the full assurance programme, part of which was previously undertaken by Deloitte. In preparation, we reviewed the scope, approach, resourcing and proposed reporting for Internal Audit’s work. The Committee agreed that Internal Audit’s opinion for 2025/26 would be published on the BBC’s website.

Internal Audit

The BBC Internal Audit function maintained its independent reporting line into me, as Chair of the ARC, and delivered a programme of internal audits aligned to the BBC’s principal risks. The team’s work features as a regular item on the Committee’s agenda.

During the year, we oversaw implementation of improvements initiated in the previous year to strengthen the Internal Audit function, including:

• embedding the recommendations from PwC’s external quality assessment of the Internal Audit function;
• introducing a revised operating model, reducing reliance on third-party providers and increasing in-house capability; and
• integrating co-sourcing arrangements into this revised operating model to provide specialist expertise to support audit delivery.

We monitored delivery of the audit plan, findings, and action closure, focusing on topics and audited areas with significant findings. During the year, 36 audits from the risk‑based audit plan were reported to the ARC, resulting in 100 improvement issues being raised. In addition, work to support the Provision 29 requirements and Trading and Separation assurance was delivered.

The satisfactory completion of audit actions remains a focus, and we note that from April 2026 the audit action closure process will be strengthened to require management to provide evidence at the point of closure; it will also extend validation of action completion to all high-priority actions.

Areas of focus for the Committee arising from Internal Audit’s work, included: international office controls, financial matters including payroll and sanctions, organisational culture and related processes, IT matters related to core processes such as payroll, assurance over broadcast resilience controls specifically within the distribution element of the broadcast chain, security and safety, operational risks, production and commissioning processes, and progress on transformation initiatives.

We also received updates from Internal Audit on their work to follow up on actions arising from external reports, including those relating to the handling of non‑editorial complaints and the data security incident relating to the BBC’s Pension Scheme. The reviews focused on the effectiveness of management’s response and progress in addressing the underlying control issues. We noted the findings and agreed that further monitoring would continue where actions were still in progress.

We approved the Internal Audit plan for the coming year and continue to oversee its effectiveness and resourcing.

I also meet regularly with the Director of Internal Audit and the Director of Quality, Risk and Assurance outside formal Committee meetings, ensuring ongoing visibility of emerging issues and the progress of assurance activity.

Whistleblowing

The Committee supported me in my role as Whistleblowing Champion, ensuring I was able to discharge my responsibilities for oversight of the integrity, independence and effectiveness of policies and procedures. We reviewed reports on allegations, trends and themes in private sessions, along with the outcomes of whistleblowing investigations to help preserve confidentiality.

Other areas of Committee attention

We oversaw the BBC’s Transformation Portfolio and major programmes, with focus on those projects with an increased uncertainty over delivery, including the Capita IT upgrade of Licence Fee systems and BBC Music Studios at East Bank, as both projects required significant attention in the year.

Additionally, we received assurance from Internal Audit on a range of areas including: the pan-BBC Group capability for resource scheduling; readiness for the BBC Charter review; the Culture Transformation project; the contingent workforce programme; and the project to relocate the BBC's Birmingham headquarters to the Tea Factory in Digbeth.

The Committee’s agenda has evolved to ensure cyber and technology risks facing the BBC are regularly discussed, and their implications for the organisation, alongside priority activities which are being implemented to further improve the BBC’s resilience planning and cyber risk position. We also received further updates on cyber security, risk appetite and residual risk acceptance during the year.

A deep dive on the BBC Pension Scheme was presented to us, including analysis on the Scheme’s illiquid investments, performance of its investment strategy, and the approach to shorter-term and longer-term strategic options for the BBC Pension Scheme. Updates on insider threat, journalist safety and geopolitical risks were also received by the Committee.

We continue to consider how culture influences the effectiveness of the control environment, and during the year we were presented with updates on bullying and harassment cases, progress on the Bullying and Harassment Transformation programme, complaints, serious case management, and Internal Audit’s assessment of the activity undertaken by the BBC in response to the externally commissioned Respect at Work review, that was published in April 2025.

In summary, I am satisfied that the Committee’s agendas were appropriately structured and aligned with its remit. I am also assured that the Committee benefited from the expertise and support necessary to discharge its duties effectively.

Looking ahead to 2026/27, we will maintain oversight of the delivery of the required 10% savings across the organisation and the BBC’s overall financial viability, alongside ongoing oversight of Licence Fee funding. Strengthening the reporting of risks and internal controls will also remain a priority, ensuring we have clear and reliable insight into the effectiveness of these.