BT Commitments Assurance Office CAO

INTRODUCTION

1. This document sets out how the Commitments Assurance Office (CAO) handles Quick Checks and Breach Investigations relevant to the Commitments and Governance Protocol (hereafter the Commitments). Where there is a need to depart from this process so that the investigation is effective and efficient, the CAO may do so, and it will explain this to interested parties. The process is summarised in the diagram in Appendix 1 to this document.
2. All our stakeholders, including the BT Compliance Committee (BTCC), Ofcom’s Openreach Monitoring Unit (OMU) and industry, expect investigations to be managed in a manner that is appropriately independent, conducted to a high standard, and has a defined process. Our investigations must meet these requirements.
3. Our process comprises 4 phases:

| Phase| Purpose

---|---|---
1| Triage stage| To assess: (1) whether an issue relates to the Commitments, or should be passed to another part of BT, and (2) whether it is sufficiently significant to merit review.
2| Quick Check stage| To ascertain sufficient facts to assess whether an issue is one of concern (requiring a full breach investigation) or whether it can be closed down at this stage (after reporting to the BTCC). Note that a Quick Check can still result in CAO recommendations for remedial actions to address identified compliance risks.

In cases where the allegation is clear-cut, this stage may be omitted and the CAO goes directly to the next step.

3| Full Breach Investigation| To ascertain the full facts to assess whether there has been a breach of the Commitments or Governance Protocol.
4| Reporting the CAO’s findings| The CAO will update the BTCC, Ofcom and any other relevant parties.

THE TRIAGE STAGE

• In the Triage Stage the CAO decides whether to accept a complaint and how to manage it. There are four possible outcomes of the Triage Stage:
  a. Matter accepted and put into the CAO’s Quick Check process (see Section 4);
  b. Matter accepted and put straight into the Full Breach Investigation process (see Section 5);
  c. The matter would be better handled by the Openreach’s Commitments Monitoring Office (CMO); or
  d. The CAO decides not to accept the matter on the basis that it is not one which relates to the Commitments (and another part of BT should manage it), or it is disproportionately slight in nature.

• The CAO will notify the complainant of the outcome of the Triage stage.

Confirming the matter is in scope to the work of the CAO

• The CAO will investigate complaints about compliance with the Commitments relevant to the BTCC’s Terms of Reference, namely:
  a. BT’s compliance with the Commitments and the Governance Protocol;
  b. whether the culture in BT and the behaviours of BT people in relation to the Commitments and Governance Protocol are conducive to BT’s compliance with them and to delivery of the Digital Communications Review (DCR) objectives; and
  c. the extent to which Ofcom’s metrics in relation to the DCR are being achieved and the objectives identified by Ofcom in the DCR Final Statement are being met.

• Given the above, the CAO is focused on compliance with the Commitments and Governance Protocol – both in letter and in spirit. Other themes (e.g. customer service, litigation, data privacy) will be passed to the relevant BT or Openreach team.

Considering whether an issue is sufficiently significant to merit review

• The CAO must use its resources efficiently. The CAO will take forward issues which appear, on their face, to raise a genuine and credible concern that there are, or may be, behaviours which are not compliant with the letter or spirit of the Commitments.
• However the CAO can decide not to investigate an issue on the basis that it is disproportionately slight in nature. Such decisions are reported to the BTCC, and it remains open for the BTCC to require an investigation if it views the matter differently. It is also open for the CAO to investigate the matter at a later date should subsequent events warrant it or further relevant information come to light.

Case allocation between the CAO and CMO

• Commitments issues should be reviewed by the team that is best placed to bring them to an effective resolution. With this in mind:
  a. The CAO will lead on issues relating only or predominantly to BT;
  b. For issues relating only or predominately to Openreach, the CAO will liaise with the CMO with a view to handing over the matter; and
  c. Where an issue involves both BT and Openreach aspects, the CAO and the CMO may work together to progress the matter.

• The approach will vary from case-to-case, but will be informed by factors such as: where the relevant conduct took place; the products involved; who would be best placed to supervise any remedial actions; any specific and well-articulated views from the CP about who should lead the review; and whether the review involves access to particularly sensitive Openreach Commercial Information (CI) or Customer Confidential Information (CCI). The CAO will keep the complainant updated about case allocation.

Use of the Quick Check or Full Breach Investigation process

• A Quick Check is exactly what the name suggests – an initial review to establish whether there are issues of concern meriting an in-depth breach investigation by the CAO, or to confirm there do not appear to be grounds for further concern on the basis of the information available. This means setting a clear timescale for reaching a decision on whether the case gives cause for concern and requires a Full Breach Investigation.
• Where the facts appear clear and well-established, the CAO can decide to dispense with a Quick Check, and move directly to the Full Breach Investigation Stage (see Section 5 below).

ACCEPTED CASES: INITIAL PREPARATIONS
Once the CAO decides to accept a case it follows the good practice steps set out below. Note that the decision to accept a case is not a finding of breach, nor is it any indication that the CAO is minded to find a breach.

Define scope

• The CAO will clarify the specific issues that the case raises. These frame the terms of the CAO’s review, including: relevant products/sectors; relevant personnel; and applicable provisions in the Commitments.
• The scoping of the investigation should not be shared prematurely with BT or Openreach managers, to mitigate the risk of attempts to unduly influence the scope of the review away from areas of potential concern.

Inform relevant BT and Openreach stakeholders

• The CAO does not undertake covert surveillance. Therefore the CAO will write to relevant stakeholders (Communications Regulatory Compliance (CRC), the CMO, the General Counsel for the relevant BT division) to inform them that an initial complaint has been received, and that the CAO will be reviewing it as a Quick Check or a Full Breach Investigation.
• Where a complainant has requested anonymity, their identity will not be disclosed.
• In the event CRC or the CMO have already investigated and responded to the issue raised, the CAO will request a copy of the relevant correspondence and documentation.

Legal Support

• The CAO will consider whether the case is one in which it is likely to wish to obtain legal advice from BT Group Legal. The CAO expects this is more likely to be the case where an accepted complaint raises novel, complex or particularly contentious issues.
• The CAO will ask the Legal Director, Competition & Regulatory Law, to provide a list of candidates from within BT Group Legal who have not been previously involved in the issues relevant to the complaint to provide legal support to the CAO.

Confidentiality

• The CAO respects requests for anonymity by complainants. However if the CAO believes the degree of confidentiality requested by a third party around the complaint will have a material impact on the effectiveness of the review, the CAO will tell the third party to discuss a way forward.
• The CAO does not undertake covert surveillance. Where the CAO accepts a case, it will tell relevant stakeholders in BT and Openreach (e.g. Communications Regulatory Compliance (CRC), the CMO, the General Counsel for the relevant BT division) that a complaint has been received, and that the CAO will be reviewing it as a Quick Check or a Full Breach Investigation.

THE QUICK CHECK PROCESS

• The Quick Check process is used for both complaints and issues that have otherwise come to the CAO’s attention. Cases are recorded on the CAO’s tracker and progress is reviewed at regular CAO team meetings.

• The CAO starts its review by gathering relevant evidence and will engage with key people in relevant parts of BT. The CAO’s approach will vary in each case, mindful that this process seeks to form an informed preliminary view on whether there is an issue or concern or not. The intention is not that there has been a comprehensive review of all potential evidence that might exist within BT Group. The test the CAO expects to use is: “have we obtained the relevant information which is available in the obvious places, and have we spoken to the key people involved?”

• Once the CAO has completed a Quick Check, the CAO Director gives a recommendation for the BTCC, which may be:
  a. To close the Quick Check (where no substantive issues have been identified);
  b. To close the Quick Check but with recommendations to BT to prevent Commitments issues arising in the future (which can include revisiting the issue in the future to confirm that the CAO’s view remains appropriate); or
  c. To open a Full Breach Investigation.

• In practice, the CAO could look to move a Quick Check to a Full Breach Investigation if there are sufficient indications that this is necessary, without waiting for the BTCC to decide this point.

• The CAO notifies the BTCC of its recommendation on the Quick Check for the BTCC to decide accordingly. The BTCC can agree with the CAO, or it can decide that a different approach is appropriate (for example the BTCC can decide that an issue should not be closed following a Quick Check and that a Full Breach Investigation should be undertaken).

THE FULL BREACH INVESTIGATION PROCESS

• This section details the general process the CAO will follow. A Full Breach Investigation takes place where either:
  a. Upon completing a Quick Check, the CAO concludes that there is sufficient information to justify a Full Breach Investigation. Depending on the timing of BTCC meetings, the CAO may proceed to this step rather than waiting for a BTCC meeting, so that it can provide its recommendations from the end of the Full Breach Investigation Process.
  b. on receipt of a report from the CAO on a Quick Check, the BTCC decides that there are reasonable grounds to suspect that a breach may have taken place (this could occur where the CAO recommends opening a Full Breach Investigation, or where the BTCC disagrees with a CAO recommendation to close a matter after completing a Quick Check); or
  c. it is clear on the face of the initial information provided to the CAO that a full breach investigation is warranted, without the need to first undertake a Quick Check.

• Nevertheless, the fact that an investigation is opened does not imply that there has been a compliance failure. It may simply be that the circumstances are particularly complex, and getting to the bottom of the issue requires a more rigorous review than a Quick Check offers.

Update Stakeholders
Where the CAO has opened a Full Breach Investigation, the CAO will update the complainant (if relevant) as well as BT and Openreach stakeholders.

Confirm the Investigation Scope
The CAO will start by looking at the scope of its review. If a Quick Check has already been undertaken, this is an opportunity to reflect on what the CAO has learned and consider whether the scope needs to be expended, reduced or should change direction. This decision will be led by the evidence that the CAO has been able to obtain.

Investigation Support

• The investigation should provide the CAO case lead sufficient evidence to form a view about whether there has been a breach of the Commitments. The CAO Director must ensure that the investigation team is adequately resourced to achieve this – this could entail reaching out to other functions to provide the necessary support to progress the investigation (e.g.BT Group Legal, CRC, BT Security).
• If the CAO’s review is likely to require access to particularly sensitive materials, the CAO must ensure that, during the investigation, any electronic files relating to the complaint are stored securely. The CAO will also adopt pragmatic steps, such as using password protection on emailed documents and access controls on intranet sites, to manage sensitive information appropriately.
• Where the CAO undertakes an email review during its investigation, it can work with BTSecurity and BT’s paralegal resource using BT’s eDiscovery platform.

Interviews

• Where the CAO conducts interviews, notes should be taken and checked back with the interviewee to obtain assurance that their views have been accurately recorded. The CAO should seek to write up any notes as soon as possible after the interview to ensure they are as accurate as possible.
• The CAO will keep any notes factual and avoid discussions of whether or not an individual may have breached the Commitments (this will be considered later, when the CAO team when forming their recommendation to the BTCC).

Legal Review
If a lawyer is supporting the CAO, they will review and comment on the CAO’s analysis and conclusions and, where relevant, any recommendations as to what remedial action should be taken.

Share Initial CAO Findings with BT and Openreach
The CAO will share its findings with BT and/or Openreach. The CAO will set a suitable deadline for a response (10 working days, but this could be less in straightforward cases, and longer in complex or novel situations). This provides a reasonable but not open-ended opportunity to respond, and the CAO will refer cases to the BTCC for decision if BT and/or Openreach has not provided its views in spite of being afforded the opportunity.

Prepare the Breach Investigation for submission to the BTCC for Decision

• The Commitments Assurance Director will review the recommendation and supporting evidence, including any representations from BT. The Commitments Assurance Director will determine the CAO’s proposed findings to the BTCC, and will notify CRC and the CMO of these.
• In the event that CRC and/or the CMO have concerns with the CAO’s findings, they can raise them with the Commitments Assurance Director. However the CAO notes that there will have been prior engagement during the review, and it expects issues to be raised as soon as practical in the process.
• If the point of difference remains, the CAO and CRC will each present their views on the issue when it is referred to the BTCC for decision.

THE REPORTING STAGE

Reporting to the BTCC

• When a case has been concluded (either a Quick Check or a Full Breach Investigation) the CAO reports its findings to the BTCC, together with any relevant CRC or Openreach CMO perspectives where relevant. The format of reporting depends on the nature of the matter and the complexity of the issues involved.

• The CAO will explain:
  a. whether or not a breach or non-conformance with policy has been identified; and
  b. what remedial action BT and/or Openreach propose to take or what action is recommended by the CAO.

• The BTCC will decide on the CAO’s recommendation. If a breach or non-conformance is found, it is recorded in the minutes.

Reporting to Complainants
The CAO will update complainants regularly about progress, including the CAO’s findings, and the BTCC’s decision.

Reporting to Other Stakeholders
Details of concluded Quick Checks and Full Breach Investigations are included in the BTCC Bulletin following the relevant BTCC meeting, as well as in the BTCC’s Annual Review.

Reporting to Ofcom
The CAO updates Ofcom on the status of any open Quick Checks and Full Breach Investigations at its regular meetings. In addition, the CAO (on behalf of the BTCC) formally writes to Ofcom within 10 working days of a BTCC meeting where any breach or non-conformance case is formally decided by the BTCC members (as per GP 7.7).

Appendix 1: Simplified overview of CAO Quick Check and Potential Breach

Investigation process

Read User Manual Online (PDF format)

Read User Manual Online (PDF format)  >>

Download This Manual (PDF format)

Download this manual  >>