Foxtel vs Netflix: How can risk management help?

“If ‘disruption’ has been the buzz word for the last 10 months, then ‘resilience’ is the yin to the yang. How are you going to manage that disruption and how resilient are you?”

This is the number one question keeping Foxtel risk director Brad Veale up at night.

And it’s no surprise given the disruption that pay television firms around the world have been experiencing thanks to the exponential growth of online streaming subscription service Netflix.

“Unfortunately for Foxtel, Netflix came on the scene very quickly and managed to create a perception that it was a replacement to Foxtel,” Veale explains.

Veale was drafted in by Foxtel last September to help the Australian firm navigate it’s new operating environment, which includes its “antidote to Netflix” ‘Presto’, an expanded business model as a broadband supplier, and the raft of regulatory and data security implications that come with it.

“With that strategic change in direction, the risk increases. As we move into a world that we’re not overly familiar with, but that we feel we need to compete in, there are a few unknowns. And that’s where the risk team can add value.”

So what is Veale’s diagnosis of Foxtel’s current resilience to Netflix?

“Netflix is not a replacement to Foxtel and it never will be. Going into a Netflix catalogue is like going to the back shelf of the video store – it’s all old stuff – it doesn’t have locally produced content, it doesn’t have sport, it doesn’t have any live news, [and] it doesn’t have as many first run dramas as we do. That said, [Netflix’s] numbers are great and it’s a great model which is proven around the globe – low number of employees, low operating costs,” he says.

Indeed, competition is the number one strategic risk to the business, Veale admits. “But I’d say our number one operational risk is information security and data management – it’s the key concern driving our business resilience programme.”

Building ‘resilience’

Veale’s remit at Foxtel is divided into four main areas: operational risk, fraud risk management (internal/external); compliance and assurance; and business resilience.

“It’s the business resilience piece that keeps me up at night,” he says.

“The way we look at resilience here at Foxtel is we have combined the four disciplines of crisis management, emergency management, business continuity and disaster recovery.”

And with two million customers, Foxtel is “very much on notice” to ensure it is resilient to cyber events like those that have recently hit Sony, Home Depot or Target.

“There’s that famous quote – there are the businesses that have been attacked and the ones that don’t know they’ve been attacked. Where do we sit? We get hundreds of DDoS (distributed denial of service) attacks every day – as does everybody else – and I think that’s one of the great unknowns in the industry is how much rebuttal and defence goes on every day within Australia and worldwide organisations.”

To benchmark Foxtel’s data management and information security defences, the firm engaged a consultant to conduct a review of its operations.

“Nothing’s badly broken but there are opportunities for improvement. I’m happy with it because it’s a lever for me,” Veale says.

One of the key recommendations is that Foxtel’s information security function is lifted up within the organisation.

“When you bury it down in the organisation it doesn’t get the right exposure and the right support,” Veale explains, adding that he reports directly to the audit and risk committee, which includes the chief executive and his boss – the chief financial officer.

Veale says it was the company’s two shareholders – Telstra and News Corp – that were keen to increase the maturity of Foxtel’s risk management operations.

“That’s what they brought me in for: someone with experience who could communicate with the board and the audit committee as well as drive the risk management culture here within Foxtel.”

And from signing off the fire-breathing Game of Thrones dragon at the Sydney Opera House to ushering Five Seconds of Summer band members past screaming teenage fans, Veale’s role has certainly been varied in its 10 short months.

But it’s also come with challenges; one of which being the business’s changed regulatory requirements.

“By becoming a telco, our risk profile and our compliance profile has changed. Now we’re subject to a whole raft of regulations that we weren’t previously. If we have a problem with a broadband as a telco provider of direct telephone lines we have to make sure that everyone has a number that emergency services can identify, you have to have continuity of service, we have the law enforcement requests, and the big one at the moment is the government changes around meta data.

“The regulator has more teeth now and the potential reputational and financial impact of that is big,” he says.

‘Why do we need a risk guy?’

Veale’s other main focus has been enhancing a risk culture within the firm.

“People think ‘we’ve gone 17 years without any major problems, why do we need a risk guy’?” Veale says.

Key to overcoming this has been Veale’s collaborative and consolatory approach, which he likens to working in “small waves as opposed to a tsunami”.

“I’ve gone in and listened to everyone; I’ve taken a bottom-up approach,” he says.

“Rather than trying to go in and convince an executive who’s very busy and under a lot of pressure about risk management, the lower hanging fruit is the next tier below. So we go in and give them some help and some guidance and then what I’m finding is that they are going in to the execs and saying ‘I caught up with Brad, he explained this to me’ and now the invites are starting to come.

“I’m finding myself on almost too many steering committees, but that’s a positive thing as the voice of risk is now at the table,” he says, citing the inherent difficulties that many risk managers face in getting a seat at the table. 

“To be effective [as a risk director], you have to be in at the genesis of ideas. Not so much that you strangle them at birth, but so that you can provide council and help navigate.”

Veale has also created a risk community within the company.

“I went through the phone directory and I invited anyone that had ‘compliance’, ‘risk’ or ‘assurance’ in their title into a meeting and said ‘ok this is going to be the risk community – it’s a forum for risk and compliance folk; you don’t report to me but this is an opportunity to understand how we will manage risk going forward’.”

It’s this kind of collaborative approach that has seen Veale progress throughout his career, starting with his first job at a local high street bank.

Boy done good

Born in Bristol, UK, Veale grew up with ambitions to become a top sports journalist. But when he was 16, an opportunity came up at a bank.

“I came from a very working class background and was the first kid in the street to get a white collar job. In those days a job in banking was a job for life,” he says. “The problem with high street banking was it’s a very structured, hierarchical culture – it’s dead man’s shoes – you had to wait until someone moved up ahead of you and your whole career was mapped out.”

Thankfully the bright lights of London called in 1986, when Veale was offered a job at Nat West Stockbrokers following the demutualisation of the London Stock Exchange in 1986.

He was then handpicked for the new Nat West compliance team and promoted to compliance manager after three years. “It sounds cliché, but I loved the fact that you could make a difference,” he says.

After nearly six years, Veale took up a role at the regulator before moving to Australia in 1997, where, at 33, he became the head of compliance for Merrill Lynch for Australia and New Zealand.

Fast forward to 2003, he moved to Macquarie, where he was tasked with introducing a risk management and compliance framework. “Macquarie was on quite an aggressive growth strategy so 10 years later I had a team of 75 globally in Australia, New Zealand, Hong Kong, Singapore, Mumbai and Canada,” he says.

Then in 2013 Macquarie underwent a restructure which gave Veale an opportunity to step away from the financial services world and spend some time with his two young daughters.

“Then out of the blue a recruiter rang and asked if I would be interested in Foxtel. I said I’d never even thought about it,” he laughs.

“The satisfying thing is that if you have risk management skills, you can bridge that gap between financial services and external industries. I’m not sure how well it would go the other way because of the complexity of regulation.

“Plus, I like a challenge. You don’t always win, but it challenges your own thinking and makes you look further into yourself and your knowledge and your values,” he says.

Veale certainly has a challenge ahead as he helps Foxtel navigate its murky, Netflix-infested, waters. And it will take a resilient ship to batter the storm.