BT Annex 1 Manufacture of Sterile Products Instruction Manual
- June 9, 2024
- BT
Table of Contents
CAO Operating Manual: Annex 1
The CAO’s approach to Monitoring Reviews
Commitments Assurance Office, BT Group
Issue: v2 June 2021
CAO Deep Dive Review Framework
We look at the Architecture, Ways of Working and People aspects of how
major projects/processes are run over their life cycle
Framework: Rationale, Usage and Assessment Standards
| Rationale | Usage |
|---|
We have this framework in order to:
• bring structure and consistency to the CAO’s deep dive review process.
• Ensure transparency by publishing the framework. It is important to us
that all stakeholders (within and outside of BT) understand how the CAO
undertakes reviews of major projects.| • This framework is used by the CAO as
a guide when conducting our monitoring reviews.
It is not a tick-box exercise.
• We share this framework with BT and we encourage them to use it to help
them to do the right thing.
• However, the decision of how to set up and run a project remains with BT.
If a particular project brings a legitimate need for a different way of
working, the CAO’s framework does not prevent this; the CAO would simply seek
to understand why this is happening, by reference to whether it supports DCR
outcomes.
Assessment Standards
The CAO uses three categories to consider whether what it observes is
consistent with the Commitments and Governance Protocol:
The 3 Key Pillars In Detail:
Our Assessment Standards
Pillar 1: Architecture
Governance; roles, responsibilities and relationships
| Poor | Expected | Role Model |
|---|
-
There is no effective governance in place or governance only considered well down the line.
-
Business owners do not demonstrate ownership of relevant governance.
-
Governance which fails to strike appropriate balance between greater Openreach independence and BT parent company oversight.
-
Role clarity:
– non-existent,
– unclear, or
– only established once a matter is well-advanced and e.g. after significant information disclosed / significant engagements have already happened.| -
A robust governance framework has been established, and is evolved where needed, to ensure it continues to operate effectively and in line with the Commitments.
-
Proactive engagement within BT of Openreach specific governance requirements which ensures the right balance between greater Openreach independence and BT parent company oversight is maintained.
-
RAPIDs agreed at the outset and used in-life.
Everyone has personal role clarity, and understands the role others on the matter are performing. -
Business owners at all levels can identify and resolve the majority of issues in-life.
-
Escalation routes are agreed at the outset of the project and clear.
-
Transparency – governance is clear to those outside the project and it is easily accessible.
-
The processes and controls set out in the Guidance Notes are followed and, where change is required, this is flagged.
-
Formalised governance:
– controls are systemised (i.e. included in relevant systems and processes), and
– controls are known, understood and operated by all involved.
| 1) The governance framework is efficient and simple.
2) Proactive consideration of both compliance risk and business risk around
governance.
3) Real-time and transparent compliance with project- specific processes, and
to a high standard that makes assurance straightforward.
Pillar 2: Ways of Working **
**
Understanding the Commitments, approach to compliance and information management
| Poor | Expected | Role Model |
|---|
- Behaviours that ignore or have little/no regard to the Commitments.
- Legalistic approach to compliance, rather than meeting the spirit of the Commitments.
- Incorrectly using the Commitments as an excuse not to do something.
- Tolerating sub-optimal working practices (e.g. lack of RAPID, lack or role clarity, poor information management).
- Disinterested in potential consequences of not living up to the Commitments.
- Evidence of weak compliance with processes (e.g. delays in making Disclosure Records, failure to apply for Regulatory Compliance Marker).
- Requesting Openreach information without
explaining what it is for, and why it is needed to fulfil a legitimate purpose. - Evidence of no or little prior thinking about how sensitive information will need to be managed.| 1) Business owners understand and apply the sections of the Commitments and Governance Protocol that are relevant to their area.
- Ways of working are agreed across the team at the outset and in line with the BT Way.
- Works to make things better: breaks down barriers, make things simple, enduring for the future. Both letter and spirit feature in people’s thinking.
- Evidence of a “Think Openreach” approach in practice that shows consideration of how the Commitments are relevant to / potentially impact on the matter at hand. E.g. when considering pan-BT initiatives, thought is given to how this might impact Openreach and they are engaged at an appropriate stage.
- Relationships which are effective, i.e. built on trust and mutual respect, and which enable robust and constructive discussions to deliver the spirit of the Commitments.
- Seeking expert advice where necessary and in good time to properly manage legal, regulatory and business risks.
- Knowing and following the rules and processes to a good standard e.g. on managing CI/CCI; use of data security tools.
- Thought given as to how to manage Openreach information in documents going to BT governance bodies.| 1) Anticipated what both BT and Openreach need commercially from a matter and ensures ways of working deliver this commercial objective in line with the Commitments.
- Striving to build ways of working in a manner that is conducive to delivery of DCR Outcomes.
- When issues or risks are identified, they are resolved in a way that works for BT and Openreach and / or raised via appropriate channels, in good time.
- When novel ways of working are required, proactively takes ownership of and resolves potential Commitments aspects.
Pillar 3: People
Commitment to DCR outcomes and personal behaviours
| Poor | Expected | Role Model |
|---|
- Motivated by “personal gain” – primarily driven by
interests of own part of the business without consideration of Commitments compliance / wider
DCR impacts. - Tensions/frictions arise as parties not clear on the
other’s drivers or aspirations, damaging trust and long
term sustainability of healthy relationships. - Incorrectly believing that there are things that cannot be done with Openreach and then blaming suboptimal business outcomes on the Commitments.
- Avoiding personal accountability: issues are swept
under the carpet (rather than faced as part of a process of continual improvement). - Being inappropriately directional in parent company role.
- Complaining about, or resenting, processes and systems rather than building a case for change and/or proposing solutions.| 1) Shows commitment to acting in a way that supports DCR outcomes, ensuring Openreach’s greater independence is respected and, Openreach’s delivery of equal treatment to its customers.
- Conscious of impact of decisions that are taken – whether something is seen as supporting or hindering DCR outcomes, and able to present solutions.
- Clarity and understanding of what is required to ensure the Parent Company can fulfil its responsibilities.
- Taking personal accountability: if tensions/issues arise, these are resolved constructively and transparently in real time using agreed processes.
- Confidence to speak up with honesty.
- Legal, regulatory and compliance support is sought where required, but not
to abrogate ownership.| 1) Drives wider business commitment to the
Commitments and DCR outcomes by inspiring others to embrace them, for example by:
– challenging legacy thinking;
– selling the rationale for and benefits of the
Commitments;
– supporting others to gain greater confidence in living the Commitments;
– encouraging healthy conflict resolution,
Process for Deep Dive Reviews
What will we be looking at?
Our methodology will follow broadly the same framework, adapted to suit the particular circumstances
- What happens and why: understanding the narrative – the chronology and the business drivers
- What is the governance: what is the RAPID, does it respect “the DCR balance” and, in due course, did it prove robust – based on our assessment standards (architecture)
- What are the processes and controls: are these and any three lines of defence models working to mitigate/manage risks work as expected – based on our assessment standards (architecture/ways of working)
- What behaviours are those involved displaying: do they align with expectations – based on our assessment standards (people)
- What do the documents show: does a review of key project documents and, where necessary, reviews of communications between key individuals substantiate our other findings (evidence – validation of all the others)
- What are the outcomes: do they align with expectations (outcomes)
- In life and looking back: how do/did key stakeholders feel: their views about how things are going/went and the outcomes achieved (outcomes)
How we work
Real time assurance
to greatest extent possible| At the outset of a matter| “In-
life”| At the conclusion
---|---|---|---
• Ensuring matters are set up the right way, with clarity of roles provides a
strong foundation for a well managed project or process
• A “critical friend” rather than “marking your homework”
• With assurance “after the event” to fill in the gaps and validate the real
time observations| • Understand project objectives, business drivers, RAPID
and processes/controls
• Identify key stakeholders – brief as necessary on review requirements
• Agree process to understand the narrative (e.g. periodic conference calls)
and document retention| • Maintain the narrative and
document collection
• Observe operation of processes and controls
• Observe key interactions as required (see next slide)
• Observe behaviours
• Offer feedback| • Review outcomes
• Seek feedback from key stakeholders
• Produce review report, share with key stakeholders and account to BTCC/Ofcom
as appropriate
• Where appropriate, hold after
action review of any lessons learneand keep performance of any
agreed actions arising under review
Real-Time Business Observations
Rationale
- There are a number of interactions between BT and Openreach that have the potential to impact on whether the DCR balance is being maintained. Whilst papers and minutes of such meetings will evidence the issues considered and decisions reached, observation is perhaps the best means to assess the culture and behaviours exhibited.
- BT has committed to provide greater transparency of how BT is working and of how it is interacting with Openreach. Ofcom have been invited to observe business training sessions, compliance committee meetings and other business activities. The CAO may also observe meetings which are not appropriate for Ofcom to attend – for example if the agenda covers matters broader than Openreach. This provides a mechanism by which Ofcom can be provided with a trusted insight into the approach being taken.
Process and Key Meetings
Strategy Development Process| Financial Planning Process| Openreach Investment
Cases
---|---|---
• In line with Guidance Note 3.
• The CAO holds regular meetings with relevant leads in BT Group strategy to
understand how the process is progressing and how BT Group and Openreach are
working together.
• The CAO may also observe relevant meetings between the parties.| • In line
with Guidance Note 4.
• The CAO holds regular meetings with relevant leads in BT Group finance to
understand how the process is progressing and how BT Group and Openreach are
working together.
• BT Investment Board (BTIB) review of Openreach capex/investment proposals.
• BTIB meetings to consider capex allocations (where some of the capex to be
allocated is Openreach capex).| • In line with Guidance Note 7.
• The CAO will observe BTIB meetings which are asked to determine Openreach
investment cases (i.e. seeking additional capex outside the MTP envelopes).
Public. v2. Commitments Assurance Office
© British Telecommunications plc 2021