ITEM 3. KEY INFORMATION

3.A Selected financial data

The information set forth under the heading “Selected financial data” on page 188 of the Annual Report 2019 is incorporated herein by reference.

3.B Capitalization and indebtedness

Not applicable

3.C Reasons for the offer and use of proceeds

Not applicable

3.D Risk factors

Principal risks and uncertainties

The principal risks and uncertainties that affect us could have an impact on our business, brand, assets, revenue, profits, liquidity and capital resources. The principal risks we described last year have evolved, and so has our response to them.

Our Enterprise Risk Management framework gives reasonable (but cannot give absolute) assurance that we’ve identified and addressed our biggest risks. However, there may be some risks that are either currently unknown, or currently seen as less important but with the potential to become more so in the future.

Events outside BT present both risks and opportunities. We focus our efforts on predicting and reducing risks while aiming to take advantage of any opportunities that may emerge.

We recognise the uncertainty that political and geopolitical risks present and have continued to operate a specific Brexit programme across BT that looks at how we might be affected and what our response should be. This programme is keeping a close watch on developments, and reports to a steering group chaired by our group CFO.

STRATEGIC RISKS

Competition & Technology Changes

Our strategy and business model could be disrupted by technology change and/or intensifying competition from established players and new entrants into our markets. This competition compounds some of the external challenges that we see in the market place, notably:

Technology change is also a key characteristic of our sector. We need to be able to identify emerging technologies, assess how customers will adopt these technologies, and invest accordingly, frequently a long-time before the demand materialises. We also need to respond to changes in the use of existing technology, such as the exponential growth the sector has seen in data consumption and network capacity requirements.

Potential impact

Intensified competition can result in lower volumes and/or prices than we currently forecast. If we do not respond effectively to competition then we can lose market share, revenue and/or profit.

In addition, new technology developments can lead to accelerated obsolescence of our current products, increased investment requirements, new sources of competition and/or the deterioration of our competitive position. This in turn can result in lower volumes and prices, stranded assets and higher costs. A failure to invest optimally in technology today can have implications for our market position and ability to generate future returns.

3

Table of Contents

What’s changed over the last year?

Set against a challenging economic climate our leading competitors have been very active over the last 12 months. Important developments included:

Communications Industry Regulation

Regulation affects much of what we do.

In the UK, where Ofcom identifies competition concerns in communications markets, it can set rules requiring us to provide certain services on specified terms to our customers. Ofcom reviews markets regularly and can introduce, extend, relax or remove rules as a result of its findings. It has powers to conduct specific investigations about market behaviour, including price levels. In addition, Ofcom can set out rules for spectrum auctions and to ensure consumer protection in the sector.

Ofcom will investigate our compliance with regulatory requirements and can impose fines and restitution on us if we fail to comply.

Ofcom also has powers to regulate the terms on which we’re supplied with certain services by others – for instance, mobile call termination – and can sort out disputes between us and other communications providers about the terms on which services are supplied. Appeals of regulatory decisions also give rise to risks (and opportunities).

Outside the UK, regulation defines where and how we are able to compete through licensing rules and defining the terms on which we are able to access networks of incumbent operators.

Potential impact

Some of our revenue comes from supplying wholesale services to markets where Ofcom has found us to have significant market power. This includes revenue relating to services where regulation requires us to cut average prices each year by a specific, real-term percentage for a three-year period.

Where other telecoms providers ask Ofcom to resolve disputes with us, there is a risk that Ofcom may set the prices at which we supply services, make us provide additional services and/or impact how we structure our business. In some circumstances, Ofcom can adjust past prices and make us pay back amounts to wholesale customers.

Regulation outside the UK can hit our revenue too. For example, overly-restrictive licensing requirements or ineffective regulation of access to other networks mean we might not be able to compete fairly. Regulation can also define and control the terms of access to necessary regulated inputs, which raises our costs.

What’s changed over the last year?

Ofcom has continued its cycle of market reviews, including consultations on the business connectivity and physical infrastructure markets and on its move to more holistic regulation of access across business and residential markets.

Ofcom also published Digital Communications Review Implementation Reports in June and November 2018 reviewing BT’s and Openreach’s adoption of the Commitments and Governance Protocol.

Consumer issues such as charges once a customer’s minimum contract term expires were part of a super-complaint made by Citizens Advice in September 2018 to the Competition and Markets Authority, which covered matters across the telecommunications and financial services sectors and has been referred back to Ofcom.

Finally, the Department for Digital, Culture, Media and Sport published its Future Telecoms Infrastructure Review in July 2018 as part of the Government’s modern Industrial Strategy, setting out a longer-term vision for the UK’s connectivity and associated infrastructure.

Political Risk

Across our operations we are exposed to the effects of political and geopolitical risks, in particular:

4

Table of Contents

Potential impact

Political uncertainty can have direct financial consequences across the economy, impacting for example foreign exchange rates, the availability and cost of capital, interest rates and also resulting in changes in the tax regime. For BT specifically, the most significant impact of political risk is its potential interaction with some of our other Principal Risks. In the UK, we’re seeing an increasing overlap between political debate and the regulatory environment, with the potential that our Communications Industry Regulation risk increases as a result.

The impacts of Brexit are still uncertain while the UK’s future trading and transition relationship with the EU is determined, albeit the agreement in principle on a number of withdrawal measures was welcome, notably the commitment to protect the rights of EU citizens living in the UK and vice versa. There is the potential for our costs to increase, for example through any changes required to our systems to reflect new taxes or customs duties or other processes. Our regulatory risk could increase if there were to be future divergence with the EU regime. Our suppliers may face disruption as a result of challenges in their own organisations and supply chains. Also, delivering a great customer experience and great network will become more challenging if it is harder for us to recruit and retain skilled talent and to source a sufficient construction workforce. The UK economy may also suffer as a result of this uncertainty.

Geopolitical risk outside the UK can most clearly impact our Communications Industry Regulation risk, but also our Security and Resilience risks where it poses a threat to the continuity of our operations.

What’s changed over the last year?

There has been continued uncertainty over the eventual nature and timing of Brexit, despite ongoing negotiations between the EU and UK to agree arrangements against a backdrop of domestic political instability that has included new political parties being established and the defection of MPs from both the Conservative and Labour parties. In the build up to the UK’s scheduled exit from the EU we’ve continued our contingency planning activities, including issuing communications to our people and working with our suppliers to understand issues such as how we can best manage stock levels through this period.

In the UK, there was continued high political interest and policy focus around communications – particularly fibre broadband and 5G. As referenced above, this included the publication by the Department for Digital, Culture, Media and Sport of its Future Telecoms Infrastructure Review in July 2018. There was also more political focus on issues like consumer pricing and contracts, and security and competition in the communications supply chain.

5

Table of Contents

FINANCIAL RISKS

Pensions Risk

We have a large funding obligation to our defined benefit (DB) pension schemes. The largest of these, the BT Pension Scheme (BTPS or Scheme), represents over 97% of our pension obligations. The BTPS faces similar risks to other UK DB schemes: things like future low investment returns, high inflation, longer life expectancy and regulatory changes may all mean the BTPS becomes more of a financial burden.

Potential impact

The next valuation of the BTPS is scheduled to take place as at 30 June 2020. When a valuation is calculated, the funding position is affected by the financial market conditions at the valuation date. When determining expected future returns on the Scheme assets, different factors are taken into account, including yields (or returns) on government bonds. If assets returns are lower than expected over the period to the next valuation, or a lower future investment return assumption is adopted at the 30 June 2020 valuation, the deficit would likely increase, potentially leading to a higher level of future deficit payments. Indirectly it may also have an adverse impact on our share price and credit rating.

Any deterioration in our credit rating would increase our cost of borrowing and may limit the availability or flexibility of future funding for the group, thereby affecting our ability to invest, pay dividends or repay debt as it matures.

What’s changed over the last year?

The actuarial valuation of the Scheme as at 30 June 2017 was announced in May 2018. This led to a £2bn contribution in June 2018, funded by proceeds from issuing long-term bonds to the BTPS. Agreement of this valuation and the associated funding plan provides certainty over the level of cash contributions required until the next triennial valuation is concluded, taking place no later than as at 30 June 2020.

As part of the actuarial valuation, we discussed the Scheme’s approach to investing assets with the Trustee. The resulting changes should help protect the BTPS from volatile investment returns and high inflation by investing in a way which provides greater certainty over the Scheme’s ability to meet benefit payments over the longer term.

We also reviewed pension arrangements for our UK people, closing Sections B and C of the BTPS to future benefit accrual on 30 June 2018 (representing more than 99% of active members at the time). This has largely removed the build-up of additional future liabilities in the BTPS.

In March 2019 The Pension Regulator issued its Annual Statement, which increased the regulatory pressure on companies – for example encouraging trustees to seek shorter Recovery Plans (of less than 7 years) and to aim for contributions no lower than dividend payments. This could potentially have a negative impact on the level and timing of BT’s cash contributions following the next valuation at 30 June 2020.

Financial Risk

In common with other major international businesses, we’re exposed to a variety of financial risks. These include treasury risks, which arise principally from market risk (including interest rate risk and foreign exchange risk), credit risk, and liquidity risk. They also include tax risk, principally that we need to understand fully the current and future tax consequences of business decisions to comply with tax rules and avoid financial and reputational damage.

Potential impact

If there is an adverse movement in foreign exchange and interest rates there could be a negative impact on the group’s profitability, cash flow, and balance sheet. Sensitivity in the income statement and shareholders’ equity arising from interest rate and foreign exchange volatility is shown in note 27 to the consolidated financial statements.

The failure of Treasury counterparties to honour financial obligations could have an adverse impact on the group’s liquidity (for example from the loss of cash deposits) and profitability (for example from increased finance expenses). A deterioration in liquidity could have an adverse impact on the Board’s assessment of going concern, particularly if combined with an inability to refinance maturing debt.

If we fail to comply with tax rules then we could face financial penalties and reputational damage. Beyond compliance, if we don’t adequately reflect the current and future tax consequences in our business decisions, we might make bad decisions resulting in financial loss and potentially financial misstatements, as well as reputational damage.

What’s changed over the last year?

We continue to face similar treasury risks as in financial year 2017/18.

Earlier in the year S&P and Fitch downgraded our credit rating, due to concerns over the effect that competing pressures, including those related to our pension and our network investments, may have on our cash flows. The three main agencies now rate us Baa2/BBB with stable outlook.

Global tax rules also continue to evolve, for example the OECD’s Base Erosion and Profit Shifting project, US tax reform, the European Commission’s challenge to tax practices under state aid provisions, and EC and UK proposals for the introduction of an interim digital services tax. All these change the current and future tax consequences of business decisions. As the external tax environment changes, we have to make more judgements to forecast the future tax consequences of business decisions.

6

Table of Contents

COMPLIANCE RISKS

Significant Financial Control Failure Risk

Financial controls, and the assurance that exists over them, play an important part in our ability to prevent and detect inappropriate behaviour and error. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Therefore even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation.

Potential impact

Failures in our financial control framework could result in financial misstatement, financial loss including a failure to prevent fraud, or key decisions being taken based on incorrect information.

What’s changed over the last year?

A new central financial controls and assurance team has been created with responsibility for setting and maintaining finance controls, policies and standards. During the year, the team continued the improvements and commenced a significant Sarbanes-Oxley control enhancement programme which identified two particular areas requiring remediation: IT general controls and risk assessment, in particular, documentation of information used in controls. Although significant improvements have been made, remediation and testing of all remediating plans was not complete at 31 March 2019 and will be a significant focus for 2019/20. We concluded that unremediated deficiencies in the two areas resulted in a material weakness in our internal control over financial reporting as at 31 March 2019 as defined by the Sarbanes-Oxley Act. As a result, management concluded that our disclosure controls and procedures were not effective to provide reasonable assurance that information required to be disclosed by us in the reports that we file or furnish under the Exchange Act is recorded, processed, summarised and reported, within the time periods specified in the applicable rules and forms.

Management also carried out an assessment of our close procedures, which resulted in more detailed and holistic quarterly reviews, improved quality and timeliness of reviews, as well as reduced duplication and increased standardisation.

The central financial controls and assurance team also support the BT units’ first line compliance teams in the enhancement of and compliance with their financial process and related control frameworks. The programme of detailed balance sheet reviews, including in our operations outside the UK have continued in 2018/19. All actions resulting from these reviews are tracked and monitored and the reviews performed in 2018/19 have not identified significant issues or areas of concern.

KPMG became our new external auditors this year. We have also brought together, under new management, our risk management, compliance, internal audit and some second line assurance functions with the intention of creating more integrated and aligned assurance activity.

Privacy, Data Protection and Governance

We control and process huge quantities of customer data around the world, so observing data privacy laws is something we take extremely seriously. It’s essential that individuals and businesses can trust us to do the right thing with their data.

We make sure our customers’ data is secure, and protected against both internal and external threats (e.g. cyber-attacks). Being trusted with our customers’ data goes further than that though. It means preserving the integrity of the personal data we process, and only keeping the things we need to provide customers with the services they’ve signed up for. It also means being transparent around how we use customer data, who we share it with, making sure the way we process personal data is legal, fair and in line with customers’ rights and wishes, and ensuring that we fulfil the legal obligations we have when customers want to exercise their rights under data legislation.

As a communications provider we currently operate under a stringent reporting regime to tell the UK Information Commissioner’s Office (ICO) if we become aware of a personal data security breach. We must also tell any affected individuals as quickly as possible if the incident is likely to have an impact on them.

An individual’s fundamental right to privacy is reflected in the fact that data privacy laws are in force in more than 100 countries. The nature of those laws varies across different parts of the world. Increasingly we (and other multinationals) have to show that we’re handling personal data in line with a complex web of national data laws and society’s ethical expectations.

Potential impact

Failing to stick to data protection and privacy laws could result in regulatory enforcement action, significant fines, class-action, prison sentences and the regulator telling us to stop processing data.

On top of that, we could see huge reputational damage and big financial losses. Those losses could come from fines and damages if we fail to meet our legal requirements, as well as the subsequent customer churn. Companies who’ve had high profile data incidents have seen a significant impact to their share price and suffered ongoing costs from their non-compliance.

What’s changed over the last year?

The EU General Data Protection Regulation (EU GDPR) came into force on 25 May 2018. It is deemed one of the biggest shake ups in data law for over a decade. It’s been created to update the existing law to ensure that individuals’ data is protected and secured and gives people a greater say as to how their data is used. It also increases their rights as to how their personal data is kept, used and retained by businesses. The sanctions for breaching the GDPR are significantly higher than under the previous regime, which could result in a substantial fine in the event of a breach.

Scrutiny from national regulators is increasing as companies are monitored to ensure they are working in compliance with the new law. In addition within the last 12 months several large companies have suffered further well-publicised data incidents.

7

Table of Contents

Health, Safety and Wellbeing

Our colleagues are crucial to our business and if they feel safe, healthy and happy they will perform better for our customers and our shareholders. Working to reduce the risk of harm to our people helps us comply with health and safety laws wherever we operate.

Many of our people, especially our UK engineers, work for much of the time in community settings where we have limited control over the working environment. Much of the network is carried above ground level and temporary work at height is a major risk for us. All of our people work in a fast-paced and highly competitive sector where change is constant and psychological pressures are significant. Managing physical and psychological hazards is therefore complex.

There is a risk we might fail to ensure the health, safety and wellbeing of our people or members of the public, in breach of health and safety laws and regulations.

Potential impact

We work to make sure our people go home safely every day. Any health and safety failure could result in injury to our people or members of the public, financial penalties, hindered or stopped operations and/or reputational damage.

The wellbeing of our colleagues is important if we’re to transform our business while continuing to recruit, retain and engage our workforce to deliver a great customer experience and grow the business. An adverse reaction to change could impact talent retention, resulting in a loss of critical skills and greater need for external recruitment, which would add cost to the business. Poor engagement also raises the risk of general industrial unrest and action.

What’s changed over the last year?

We aim to adapt our technology and working practices to help reduce the physical risks to our people, although there can be no assurances that these changes will be successful. For example, this year we introduced new TETRA ladders to the Openreach workforce to support safer working at height.

In parallel, a change in our workforce is increasing risks in areas such as driving. We’ve had a mature workforce with little labour turnover for many years. That cadre is reaching retirement age and so we’re recruiting large numbers of younger people. The new intake may have a different risk attitude, combined with less experience, so we need to make sure we put in additional safeguards with less reliance on expertise and individual judgement.

The pace of upgrading the network, fixed and mobile, has continued to accelerate. That increases our civil engineering workload and the hazards and risks associated with that type of work.

The pace and scale of change within the business has also continued to accelerate and we’re aware this has a psychological impact on our people. Finally, we’ve also appointed a new Director of Health, Safety and Wellbeing this year.

Ethical Culture

It’s crucial that we maintain high ethical standards. We respect human rights and we don’t tolerate fraud, bribery, any form of corruption or any illegal or unethical activity.

We follow local and international law, including anti-corruption and bribery laws. The UK Bribery Act and US Foreign Corrupt Practices Act (FCPA) have extraterritorial reach, so cover our global operations. We also have to make sure we follow trade sanctions and import and export controls. We comply with the Modern Slavery Act and follow international standards on human rights, such as the International Labour Organisation’s Principles and the UN Guiding Principles on Business and Human Rights.

We also face the risks associated with inappropriate and unethical behaviour in local and other markets by our people or associates, such as suppliers or agents, which can be difficult to detect. There is also a risk that our controls, which are designed to prevent, detect and correct such behaviour, may be circumvented. Controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and there can be no assurance that any design will succeed in achieving its stated goals under all potential conditions, regardless of how remote.

Potential impact

If our people, or associates like suppliers or agents, breach anti-corruption, bribery, sanctions or other legislation there could be significant penalties, criminal prosecution and damage to our brand and reputation. This could have an impact on future revenue and cash flow depending on the nature of the breach, the legislation concerned and any penalties. If we were accused of corruption, bribery, human rights abuses, violating sanctions regulations or other laws, it could lead to reputational damage with investors, regulators, civil society and customers. A breakdown in our financial control framework could result in financial misstatement.

What’s changed over the last year?

We’ve seen an increase in Speak Up (BT’s confidential whistleblowing service) reports and conflict of interest registrations. This is indicative of a culture where people are more aware and confident to tell us about their concerns.

8

Table of Contents

In terms of anti-corruption and bribery enforcement generally, we’ve continued to see a steady flow of significant cases from both the UK Bribery Act and the FCPA. There’s also been an increase in legislation (either enacted or proposed) to address and report on human rights abuses by companies.

9

Table of Contents

OPERATIONAL RISKS

Customer Experience

There is a risk that our customer experience (products and services, culture, brand, processes, leadership, technology, people and policies) may not be brand enhancing nor drive sustainable profitable revenue growth.

Potential impact

If we don’t deliver a great customer experience it could damage our brand, cause customers to leave and so reduce our revenue, or even lead to financial penalties. It could also impact our people’s pride in working for BT. Perceptions around poor customer experience also have the potential to influence political and regulatory discussions and interventions, which can in turn then impact our business.

What’s changed over the last year?

Customer complaints to Ofcom reduced by a third for both BT’s consumer broadband and EE’s mobile customers when measured on a year on year basis. From the 1 ^st April, Consumer has chosen to automatically compensate BT brand customers if we miss our provision or repair promises. EE will join this scheme in 2020 with Plusnet to follow.

Our consumer brands came together under a new Consumer Unit and we combined Business & Public Sector with Wholesale & Ventures to create a new ‘Enterprise’ division. Our One BT change programme includes activity to simplify the way we work. However, as that and other change programmes progress, there emerges an associated risk that the volume of change across BT could result in a loss of focus on delivering for the customer.

We also launched our new Be There brand positioning and launch new and innovative products to further enhance our customers’ experience.

Major Contracts

We have a number of complex and high-value national and multinational customer contracts. The revenue and profitability of these contracts are affected by things like: variation in cost; achieving cost savings anticipated in contract pricing (both in terms of scale and time); delays in achieving agreed milestones owing to factors either in or out of our control; changes in customers’ needs, their budgets, strategies or businesses; and our suppliers’ performance. Any of these factors could make a contract less profitable or even loss-making.

The degree of risk varies with the scope and life of the contract and is typically higher in the early stages. Some customer contracts need investment in the early stages, which we then expect to recover over the life of the contract.

Major contracts often involve implementing new systems and communications networks, transforming legacy networks, managing customer networks and developing new technologies. Delays or missed milestones might have an impact on us recovering these upfront costs. There’s a substantial performance risk throughout the term of some of these highly-complex contracts.

Potential impact

If we don’t manage to meet our commitments under these contracts – or if customers’ needs, budgets, strategies or businesses change – then our expected future revenue, profitability and cash generation may go down. Unexpectedly high costs associated with fulfilling particular transformational contracts could also hit profitability. Earnings may drop. Contracts may even become loss-making through loss of revenue, changes to customers’ businesses (due to, for example, mergers or acquisitions), business failure or contract termination.

One of our highest profile contracts is providing a key element of the UK Emergency Services Network (ESN) on our EE mobile network. The complexities described above all apply to this programme. This service is delivered with several partners and managed by the Home Office. Furthermore, the criticality of this service increases our risk exposure, and given the network provides emergency services communications for the UK, any in-life network performance issues could have reputational consequences for BT.

We’re continuing to deliver contracts with local authorities through regional fibre deployment programmes, including the Broadband Delivery UK programme (BDUK). As with our other major contracts, if we fail to deliver these contracts successfully it might lead to reduced future revenue, profitability and cash generation. As well as carrying a higher reputational risk, these contracts present specific risks around deployment, delivery and our ability to recover public funding. We also have an obligation to potentially either reinvest or repay grant funding depending on lots of different factors – including how many customers take up a new service.

What’s changed over the last year?

Governance and risk management over our major customer contracts remains a key area of focus. Initiatives over the course of the year have included a focus on: learning more about why the performance of some contracts deteriorates and how to stop it happening in future; the process for management reviewing contracts; long-term forecasting; our contract management systems and governance processes; and redefining and enhancing our controls and assurance.

On top of deploying the second and third phases of our BDUK contracts, we continued to win new BDUK work to further extend coverage of superfast broadband in rural areas. Although these third phase contracts are smaller in scale and coverage, the deployment challenges are significantly greater in terms of the geography encountered as we reach further into the final 5% of households.

10

Table of Contents

We also agreed a new ESN contract framework with the Government. While our broadband contracts and ESN carry a different risk profile to other major corporate contracts, we apply our governance and reporting processes to make sure we identify risks and mitigation activities and report them to management.

Service Interruption

Our commercial success is firmly rooted in our reputation for the security and resilience of our services. So we strive to maintain the highest standards of protection and incident management in order to confront the natural perils, network and system faults, and malicious acts that threaten our operations.

There is a risk we are unable to prevent and respond to incidents caused by natural perils, network and system faults, and malicious acts that threaten our network We may also fail to prevent interruption to our services as a result of supply chain failure, software changes, equipment faults, fire, flood, infrastructure outages and sabotage.

Potential impact

The consequences of service interruption can include major financial loss, long-term damage to reputation and loss of market share. Regulatory sanctions, fines and contract penalties might be applied, contracts might be terminated, and costly concessions might be needed, together with unplanned and rapid improvements to retain business and rebuild trust. We might also miss opportunities to grow revenue and launch new services ahead of the competition.

What’s changed over the last year?

Extreme weather always challenges our IT and network estate. This year we had to keep our network operating through the joint hottest UK summer on record, lightning storms and heavy rain. Another driver of service interruption can arise from technology aging and no longer being supported by its suppliers. We’ve therefore particularly focused on technology lifecycle management to recognise and manage the risks associated with our systems estate over time.

Cyber and Information Security

Security risks could arise from people inside BT or from external sources like hacktivists, criminals, terrorists or nation states attacking our infrastructure and assets, for example through use of hacking tools, phishing scams and disruptive malware.

As noted above, our commercial success is firmly rooted in our reputation for the security and resilience of our services. So we strive to, as far as possible, detect, prevent, limit the impact of and respond to any cyber-attacks that threaten our operations.

By monitoring cyber-attacks on our networks and systems and our peers and customers, we see that hacking tools, phishing scams and disruptive malware are becoming more sophisticated and yet more accessible to attackers. In response, we continue to develop our cyber defence capability, make use of proactive threat hunting and invest more in automatic detection and prevention systems.

Potential impact

The consequences of security risks can include major financial loss, long-term damage to reputation and loss of market share. Regulatory sanctions, fines and contract penalties might be applied, contracts might be terminated, and costly concessions might be needed, together with unplanned and rapid improvements to retain business and rebuild trust. We might also miss opportunities to grow revenue and launch new services ahead of the competition.

What’s changed over the last year?

Cyber attackers are learning how to defeat conventional defences such as Anti-Virus (AV), proxy servers, and basic authentication. They are changing malware signatures faster than AV vendors can deliver matching identity files, launching Denial of Service attacks that are disguised as legitimate traffic at the application level, and using increasingly convincing phishing emails to trick users into giving access to restricted systems. The growth in ransomware attacks has made headline news and caused significant disruption to some of our corporate customers, but we have so far managed to avoid such consequences. Our incident management teams are gaining experience from these events and applying lessons learned to improve our responses. We’re also helping customers by sharing this expertise.

Major corporates have continued to fall victim to cyberattack, with a number of high-profile incidents occurring in 2018/19. Also of particular significance this year was the EU General Data Protection Regulation (EU GDPR) coming into force on 25 May 2018, which could be relevant to this risk where a cyber-attack also results in a data breach.

Supplier Risk

We operate in a global supply market. Our supply chains range from simple to very complex. It’s critical to our operations that we can guarantee their integrity and continuity.

Global markets expose us to global risks, including different standards in labour, environmental and climate change practices, increasing regulation and geopolitical events. We weigh up the impact and likelihood of external market forces on our suppliers’ ability to support us.

11

Table of Contents

Globalisation means better sourcing opportunities, but brings challenges if suppliers become more geographically and culturally remote from our customers – or if governments put barriers in the way of doing business to protect national or regional economic interests.

Our dealings with suppliers follow our trading and ethical policies, from the way we choose them to the contracts we sign and how we pay them.

Potential impact

If something goes wrong in our supply chain, the speed and scale of impact can vary. We need to determine the potential damage to customer experience, the likelihood of higher costs and the potential damage to our brand. If substituting a failing supplier meant that we had to disrupt our business, it could cost us a lot of time and money. If we couldn’t find an alternative supplier, it might compromise the commitments we make to our customers, which could in turn lead to breach of contract, lost revenue or penalties.

If any link in our supply chain falls foul of the law, or fails to meet our ethical expectations, that could damage our reputation – possibly leading to legal action, fines and lost revenue.

If we don’t meet the expectations of regulators that govern us and the data we manage, it could result in significant penalties. In the case of EU General Data Protection Regulation 2018, this could amount to 4% of our global annual turnover.

What’s changed over the last year?

We dedicate time to assessing emerging geopolitical threats and the impact they could have on our supply chain. These include the impacts of the UK vote to leave the EU, which has required extensive preparation on our part to understand our suppliers’ readiness and the impact the availability of goods and services. Other impacts of supplier risk include the threat of modern slavery and human trafficking; and the growing threat of cyber-attacks on our systems and networks where our suppliers represent a source of vulnerability.

We continue to monitor the trend for mergers and acquisitions in some of the global markets we do business in. It highlights the risk of us becoming too dependent on single or monopolistic suppliers. We also try to make sure that suppliers do not become too dependent on us. Both scenarios are unhealthy for our business.

With EU GDPR coming into force, we worked closely with our suppliers through the year to help protect our people and customers and incorporate privacy-by-design and default into the products and services they supply us. More broadly, we have also started work to establish a new centralised third-party risk and control capability.

Over the course of the year there has been significant geo-political focus on Huawei, one of our major suppliers whose products include mobile handsets and also equipment for both current networks and for future 5G networks. On 15 May 2019, the U.S. government issued an Executive Order relating to the information and communications technology and services supply chain, which allows for the prohibition of certain transactions that pose a risk to U.S. national security. On 16 May 2019, the U.S. Department of Commerce amended its Entity List of restricted persons to include a number of Huawei entities. Certain transactions with the listed Huawei entities of any item subject to the Export Administration Regulations now require prior licensing. On 20 May 2019, the Department of Commerce issued a Temporary General License allowing specified activities for a period of 90 days. We have been closely monitoring these developments and will continue to do so as governments determine their future policies. In December 2018 we announced that in line with our long-standing network architecture principles around the use of Huawei, we will replace the current Huawei 4G core (inherited through the EE acquisition). This will be implemented as we move to a future new and combined 4G/5G core.

Colleague Engagement

Our people are central to everything we do and a vital part of our ambition to deliver a great customer experience and sustainable, profitable revenue growth. Our people strategy supports this ambition by creating an inclusive and enjoyable workplace so that our people can thrive as part of a dynamic business. Great employee engagement is necessary to ensure we meet our strategic aims.

Potential impact

We need to transform our business while also continuing to recruit, retain and engage our workforce to deliver a great customer experience and grow the business. An adverse reaction to change could impact talent retention resulting in a loss of critical skills and greater need for external recruitment, which would add cost to the business. Poor engagement also raises the risk of general industrial unrest and action, which in turn could cause disruption to our operations and the services that we provide to our customers.

What’s changed over the last year?

We’ve worked constructively with our unions this year to agree a number of transformation initiatives, including changes to our defined benefit pension scheme and the TUPE transfer of our people into Openreach Limited. As we create a simpler business, we’re also working closely with them to roll out a new people framework defining job families and career levels for our people.

Change Management

We are implementing a wide-ranging change programme across the entire organisation known as One BT. We need to continue to deliver differentiated customer experiences, whilst being able to have the financial capacity to invest in integrated network leadership. At the same time, we want BT to be a simple and agile business where our people can thrive.

In transforming our operating model, we need to manage this change carefully to ensure it delivers the desired outcomes. We recognise that such extensive change can also be a distraction and can cause uncertainty amongst our colleagues, so it’s important that we keep focused on delivering for our customers.

12

Table of Contents

Potential impact

If we do not manage our change programmes carefully then they will not deliver the business outcomes that we are trying to achieve. That could result in poorer customer experiences, negative impacts on employee engagement, or potential overspend on the projects themselves, and at the end of the programmes we may not have achieved the efficient processes needed to deliver a great customer experience, the desired cost savings, or differentiated products and services we were trying to launch.

As we describe elsewhere, we’ve been working hard on improving our customers’ experiences. If our transformation programmes do not deliver their intended customer benefits, or divert colleagues’ attention away from serving our customers, then we may suffer a reduction in the quality of the service we provide, and as a result incur customer churn and even financial penalties in some cases.

There is also a risk that we could overspend on the change programme itself.

What’s changed over the last year?

Over the past year, we have progressed delivery of our BT transformation plan and reorganising our business, including establishing a new people framework for our management grades. Work has continued delivering a new Digital Global Services with a new organisational structure. We have also completed the integration of our Business and Public Sector and Wholesale and Ventures units into a single new Enterprise unit.