10 Risk Strategy Report and Appendix
North Ayrshire Council · 16 June 2022
Back to Integration Joint Board — 16 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Integrated Joint Board 16 June 2022 Agenda Item No. Subject: Risk Management Strategy Purpose: To seek approval for the updated partnership risk management strategy Recommendation: The IJB are asked to approve the risk management strategy detailed in Appendix 1. Glossary of Terms NHS AA NHS Ayrshire and Arran NAHSCP North Ayrshire Health and Social Care Partnership IJB Integration Joint Board PSMT Partnership Senior Management Team PAC Performance and Audit Committee 1. EXECUTIVE SUMMARY 1.1 The partnership's Risk Management Strategy outlines the process established to identify risk, evaluate the potential consequences and to support plans for the most effective method of controlling or responding to risks. 1.2 To ensure that the management of risk is integrated within the partnership, the process forms part of the partnership’s governance framework. The Risk Management Strategy is due for review, having been put into place when the partnership was formed. 2. BACKGROUND 2.1 The previous strategy was approved by the North Ayrshire IJB in June 2019 and the strategy needs to be reviewed every three years as a minimum. 2.2 The updated Strategy reflects the process for North Ayrshire with only minor presentational changes. 2.3 The Strategy includes a requirement for the preparation of a risk appetite statement and Strategic Risk Register which have already been approved by the IJB.
Page 2
3. PROPOSALS 3.1 It is proposed to approve the risk management strategy detailed in Appendix 1. 3.2 Anticipated Outcomes The primary objectives of this strategy will be to: promote awareness of risk and define responsibility for managing risk within the IJB; and establish standards and principles for the efficient management of risk, including regular monitoring, reporting and review. This strategy takes a positive and holistic approach to risk management. The scope applies to all risks, whether relating to the clinical and care environment, employee safety and wellbeing, business risk, opportunities or threats. 3.3 Measuring Impact The PSMT is responsible for providing assurance to the IJB that the Risk Management Strategy is being applied effectively across the Partnership. Reviewing the IJB’s risk management arrangements on a regular basis will also constitute a ‘Plan/ Do/ Study/ Act’ review cycle that will shape future risk management priorities and activities of the IJB, inform subsequent revisions of this policy and strategy and drive continuous improvement in risk management across the IJB. 4. IMPLICATIONS Financial: None Human Resources: None Legal: None Equality: None Environmental & Sustainability: None Key Priorities: Appropriate and effective risk management practice will deliver better outcomes for the people of North Ayrshire, protecting the health, safety and wellbeing of everyone who engages with the IJB or for maximising opportunity, delivering innovation and best value, and increasing performance. Risk Implications: Failure to approve the report would result in a disconnect between the Risk Management Strategy and the partnership practice in relation to risk management. Community Benefits: None 5. CONSULTATION 5.1 None. 6. CONCLUSION
Page 3
6.1 The IJB are asked to: (a) Approve the risk management strategy detailed in Appendix 1. For more information please contact: Paul Doak, Head of Finance and Transformation at pdoak@north-ayrshire.gov.uk or Eleanor Currie, Principal Manager – Finance at eleanorcurrie@north-ayrshire.gov.uk
Page 4
Version No. 3.0 Date Effective: 17 June 2022 Review Date: 18 June 2025 North Ayrshire Integration Joint Board Risk Management Strategy Version No: 3.0 Prepared By: Eleanor Currie, Principal Manager - Finance Effective From: 17th June 2022 Review Date: 18th June 2025 Lead Reviewer: Paul Doak, Chief Finance & Transformation Officer Dissemination Arrangements: “This Strategy underpins the commitment to robust risk management within the North Ayrshire Health and Social Care Partnership and must be read in conjunction with NHS Ayrshire & Arran and North Ayrshire Council Risk Management Strategies” – Chief Officer
Page 5
1 Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 CONTENTS Policy – the risk management approach .............................................................................................. 2 Strategy - Implementing the policy ....................................................................................................... 3 Introduction .......................................................................................................................................... 3 Risk management process .................................................................................................................... 3 Application of good risk management across the IJB activities ......................................................... 4 Risk leadership and accountability ....................................................................................................... 5 Governance, roles and responsibilities ................................................................................................ 5 Resourcing risk management ............................................................................................................... 6 Resourcing the risk management framework ...................................................................................... 6 Training, learning and development ..................................................................................................... 7 Risk management training and development opportunities ............................................................... 7 Monitoring activity and performance .................................................................................................... 7 Monitoring risk management activity and performance ...................................................................... 7 Communicating risk management ........................................................................................................ 7 Communicating, consulting on and reviewing the risk management framework .............................. 7 Appendix 1 Risk Management – A Quick Guide ................................................................................... 8 All of our publications are available in different languages, larger print, Braille (English only), audio tape or another format of your choice. Email whatmatterstoyou@north-ayrshire.gov.uk for more information.
Page 6
2 Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 Policy – the risk management approach The Integration Joint Board (IJB) is committed to a culture where the workforce is encouraged to develop new initiatives, improve performance and achieve goals safely, effectively and efficiently by appropriate application of good risk management practice. Appropriate and effective risk management practice will be embraced throughout the IJB as an enabler of success, whether delivering better outcomes for the people of North Ayrshire, protecting the health, safety and wellbeing of everyone who engages with the IJB or for maximising opportunity, delivering innovation and best value, and increasing performance. In doing so the IJB aims to provide safe and effective care and treatment for patients and clients, and a safe working environment within the IJB and for others who interact with the services delivered under the direction of the IJB. The IJB purposefully seek to promote an environment that is risk ‘aware’ and strives to place risk management information at the heart of key decisions. This means that the IJB can take an effective approach to managing risk in a way that both address significant challenges and enable positive outcomes. Risk appetite is the amount of risk which is judged tolerable and justifiable. It is the amount of risk that any organisation is prepared to tolerate or be exposed to at any one point in time. A formal risk appetite statement requires to be agreed annually by the IJB. The IJB promotes the pursuit of opportunities that will support the delivery of the Strategic Plan. Opportunity related risk must be carefully evaluated in the context of the anticipated benefits for patients, clients and the organisation. The IJB and PAC will receive regular updates on the strategic and operational risks to provide assurance on the adequacy but also the effectiveness of its risk management arrangements. The IJB through the following risk management strategy, has established a Risk Management Framework, which covers risk policy, procedure, process, systems, risk management roles and responsibilities. The IJB recognise that the planning and delivery of health and social care services involves having to manage risk. The IJB is responsible for the operational oversight of services and through the Chief Officer is responsible for the operational management and delivery of these services. Caring for people, managing staff, facilities and finances are all, by their nature, activities that involve risk. These risks cannot be avoided completely but can be managed to an acceptable level. This Risk Management Strategy describes the risk management arrangements for North Ayrshire IJB and forms part of the wider framework for corporate governance and internal control. Key benefits of effective risk management: risk ‘aware’ not risk ‘averse’ decisions are based on a balanced assessment of risk and enable acceptance of certain risks in order to achieve a particular goal or reward; high achievement of objectives and targets; high levels of morale and productivity; better use and prioritisation of resources; high levels of user experience/ satisfaction with a consequent reduction in adverse incidents, claims and/ or litigation; and a positive reputation established for the IJB.
Page 7
3 Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 Strategy - Implementing the policy Introduction The primary objectives of this strategy will be to: promote awareness of risk and define responsibilities for managing risk within the IJB; maximise opportunities to improve service delivery; establish communication and sharing of risk information through all areas of the IJB; outline measures to reduce the IJB exposure to risk and potential loss; and, establish standards and principles for the efficient management of risk, including regular monitoring, reporting and review. This strategy takes a positive and holistic approach to risk management. The scope applies to all risks, whether relating to the clinical and care environment, employee safety and wellbeing, business risk, opportunities or threats. Strategic risks represent the potential for the IJB to achieve (opportunity) or fail to meet (threat) its desired outcomes and objectives as set out within the Strategic Plan. Typically these risks requirestrategic leadership to identify and implement appropriate mitigations to manage the risk. Operational risks represent the potential for impact (opportunity or threat) within or arising from the activites of an individual service area or team operating within the scope of the IJB’s activities. Parent bodies will retain responsibility for managing operational risks as operational risks will be more ‘front-line’ in nature and the development of activities and controls to respond to these risks can be led by local managers and team leaders. Where an operational risk impact across multiple service areas or, because of interdependencies, require more strategic leadership, then these can be proposed for escalation to ‘strategic risk’ status for the IJB and where required the parent organisation. All risks will be evaluated consistently with risks categorised as being very high/high/moderate/low and red/amber/yellow/green. Further information can be found at Appendix 1. Risk management process Risk Management is about the culture, processes and structures that are directed towards realising potential opportunities whilst managing adverse effects1 It is pro-active in understanding risk and uncertainty, it learns and builds upon existing good practice and is a continually evolving process. The risk management framework ensures that information about risks is adequately reported and used as a basis for decision making and accountability at all levels. The IJB embeds risk management practice by consistent application of the risk management process shown in the diagram on the right, across all areas of service delivery and business activities. Further information in relation to the Risk Managment Process can be found at Appendix 1. Figure 1 Risk Management Process 1 Australia/ New Zealand Risk Management Standard, AS/NZS 4360: 2004
Page 8
4 Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 Application of good risk management across IJB activities The following standard procedures will be implemented across all areas of activity that are under the direction of the IJB in order to achieve consistent and effective implementation of the Risk Managment Strategy. 1. Implementation of the risk management process, means that risk management information should (wherever possible) be used to guide decision making in the same way that cost and benefit analysis is used. 2. Identification of risk using standard methodologies, and involving subject experts who have knowledge and experience of the activity or process under consideration. 3. Categorisation of risk under the headings below: • Strategic Risks: such as risks that may arise from Political, Economical, Social, Technological, Legislative and Environmental factors that impact on the overall delivery of the Strategic Plan outcomes. • Operational Risks: such as risks that may arise from or impact on Clinical Care and Treatment, Social Care and Treatment, Customer Service, Employee Health, Safety & Well-being, Business Continuity/ Supply Chain, Information Security and Asset Management. 4. Appropriate ownership of risk. Specific risks will be owned by/ assigned to whoever is best placed to manage the risk and oversee the development and implementation of mitigation/control measures. 5. Consistent application of the agreed risk matrix. Necessary to analyse and prioritise risk in terms of consequences and likelihood of occurrence, taking into account the effectiveness of risk control measures in place. Consistent application of the risk matrix is also key to compare risks against tolerance thresholds. The risk matrix to be used is attached in Appendix 1. 6. Consistent response to risk that is proportionate to the level of risk. This means that risk may be terminated; transferred elsewhere (ie to another partner or third party); tolerated as it is; or, treated with measures to bring it to a level where it is tolerable for the IJB in keeping with its appetite/ tolerance for risk. In the case of opportunities, the IJB may ‘take’ an informed risk in terms of tolerating it if the opportunity is judged to be (1) worthwhile pursuing and (2) the IJB is confident in its ability to achieve the benefits and to manage/ contain the associated risk. Further information can be found at Appendix 1. 7. Implementation and maintenance of live risk registers. Used as a means of collating and recording risk information in a consistent format allowing comparison of risk evaluations, informed decision-making in relation to prioritising resources and ease of access to information for risk reporting. 8. Reporting of strategic risks and key operational risks to the IJB on a six monthly basis. 9. Operation of a procedure for escalation of risks between operational and strategic risk registers that will be managed/controlled by the PSMT. 10. Routine reporting of risk information as part of business as usual. Reporting and review within and across teams and a commitment to a ‘lessons learned’ culture that seeks to learn from both good and poor experience in order to replicate good practice and reduce adverse events and associated complaints and claims.
Page 9
5 Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 Risk leadership and accountability Governance, roles and responsibilities Integration Joint board Members of the Integration Joint Board are responsible for: Oversight of risk management arrangements through the Performance and Audit Committee; Seeking assurances from the Partnership Senior Managment Team that effective risk management arrangements are in place; Receipt and review of reports on strategic risks and any key operational risks that require to be brought to the IJB’s attention; and, Ensuring they are aware of any risks linked to recommendations from the Chief Officer concerning new priorities/ policies/ emerging risks and opportunities. The IJB delegated certain aspects of risk governance to the Clinical Care and Goverance Group and the Performance and Audit Committee. Each Committee has a responsibility to provide assusrance to the IJB in respect of the areas detailed below: • PAC – the PAC through Internal Audit, external audit and other sources will provide independent objective assurance to the IJB on the extent to which the risk management arrangements in place are effective: • Clinical Care and Governance Group will monitor and review risks falling within it’s remit, this including regular consideration of all high or very high operational risks. Chief Officer The Chief Officer has overall accountability for the IJB’s risk management framework, ensuring that suitable and effective arrangements are in place to manage the risks relating to the functions within the scope of the IJB. The Chief Officer will keep the Chief Executives of the IJB’s partner bodies and members of the IJB informed of any significant existing or emerging risks that could seriously impact the IJB’s ability to deliver the outcomes of the Strategic Plan or the reputation of the IJB Chief Finance and Transformation Officer The Chief Finance and Transformation Officer will be responsible for promoting arrangements to identify and manage key business risks, risk mitigation and insurance. Partnership Senior Management Team (PSMT) Members of the Partnership Senior Management Team are responsible (either collectively, or by nominating a specific member of the team) for: supporting the Chief Officer and Chief Finance and Transformation Officer in fulfilling their risk management responsibilities; arranging professional risk management support, guidance and training from partner bodies; receipt and review of regular risk reports on strategic, shared and key operational risks and escalating any matters of concern to the IJB; ensure the impact of decisions made in terms of risk and opportunities do not have a negative impact on insurance and self insurance arrangments. Key specialist advisors should be involved in decision making processes at the earliest opportunity where practicable; and
Page 10
6 Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 ensuring that the standard procedures set out in this doucment and supporting documentation are actively promoted across their teams and within their areas of responsibility. Individual Risk Owners It is the responsibility of each risk owner to ensure that they understand their responsibility in relation to the managment of risk and specifically; risks assigned to them are analysed in keeping with the agreed risk matrix; measure effectiveness of existing controls and the mitigations in place to manage the risk are proportionate to the context and level of risk;. monitor the timely implementation of additional mitigation/controls where required; risk is reviewed not only in terms of likelihood and impact of occurrence, but takes account of any changes in context that may affect the risk; and risks are defined clearly to make explicit the scope of the challenge, opportunity or hazard and the consequences that may arise. All persons working under the direction of the IJB Risk management should be integrated into daily activities with everyone involved in identifying current and potential risks where they work. Individuals have a responsibility to make every effort to be aware of situations which place them or others at risk, report identified hazards and implement safe working practices developed within their service areas. This approach requires everyone to understand: the risks that relate to their roles and activities; how their actions relate to their own, their patients, their services users / clients and public safety; their accountability for particular risks and how they can manage them; the importance of flagging up incidents and/ or near misses to allow lessons to be learned and contribute to ongoing improvement of risk management arrangements; and, that good risk management is a key part of the IJB’s culture. Partner Bodies It is the responsibility of relevant specialists from the partner bodies, (such as internal audit, external audit, clinical and non clinical risk managers and health and safety advisers) to consider the implications of risks and provide relevant advice. It is the responsibility of the partner bodies to ensure they routinely seek to identify any residual risks and liabilities they retain in relation to the activities under the direction of the IJB. Resourcing risk management Resourcing the risk management framework The work on developing and leading the ongoing implementation of the risk management framework and accociated training for the IJB and employees will be resourced through the Partnership Senior Management Team’s arrangements. Final decisions in respect of the risk management arrangements will sit with the Chief Officer and Chief Financial Officer.
Page 11
7 Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 Training, learning and development Risk management training and development opportunities To implement effectively this strategy, it is essential for staff to have the competence and capacity for managing risk and handling risk judgements with confidence, to focus on learning from events and past experience in relation to what has worked well or could have been managed better, and to focus on identifying malfunctioning ‘systems’ rather than people. Training is important and is essential in embedding a positive risk management culture across all activities under the direction of the IJB and in developing risk management maturity. Training can be accessed via North Ayrshire Council or NHS Ayrhire and Arran. Specific training sessions can also be delivered. Monitoring activity and performance Monitoring risk management activity and performance A suitable system is required to ensure risk management activity and performance is monitored. Monitoring will include review of the IJB’s risk profile at Partnership Senior Management Team level. The PSMT is responsible for providing assurance to the IJB that the Risk Management Strategy is being applied effectively across the Partnership. Key Performance Indicators (KPIs) will be linked where appropriate to specific risks to provide assurance on the performance of certain control measures. For example, specific clinical incident data can provide assurance that risks associated with the delivery of clinical care are controlled. The performance data linked to the Strategic Plan will also inform the identification of new risks or highlight where existing risks require more attention. Reviewing the IJB’s risk management arrangements on a regular basis will also constitute a ‘Plan/ Do/ Study/ Act’ review cycle that will shape future risk management priorities and activities of the IJB, inform subsequent revisions of this strategy and drive continuous improvement in risk management across the IJB. It is expected that partner bodies will use IJB risk reports to keep their own organisations updated on the management of the risks, highlighting any IJB risks that might impact on the partner organisation. Communicating risk management Communicating, consulting on and reviewing the risk management framework Effective communication of key risk management information across the IJB is essential to developing a consistent and effective approach to risk management. Copies of this policy and strategy will be widely circulated via the Partnership Senior Management Team and will form the basis of any risk management training arranged by the IJB. This strategy will be reviewed every three years or earlier if required to ensure that it reflects current standards and best practice in risk management and fully reflects the Integration Joint Board’s business environment.
Page 12
8 Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 Appendix 1 Risk Management – A Quick Guide What is Risk Management and why do we have to do it? Risk is something that may have an impact on the achievement of our objectives. This could be an opportunity as well as a threat. Good risk management means that we have a better understanding of what risks and opportunities the organisation may face and how it can best manage them. This quick guide provides basic details on the risk management process more detailed information in relation to using risk register software, service risk registers, peer review process etc can be found in the supporting Management of Risk Guidance document. Understanding and managing threats or risks comes down to four very simple questions: 1. What are the things that could happen to us? 2. What is the likelihood of them happening? 3. What would be the impact? 4. What can we do about it? (How can we prevent it from happening, or what can we put in place to manage it if it should?) There are several tools which can be used to answer these questions. For simplicity and ease of understanding our approach is to use a simple 4 stage process of identification, assessment, management and review to ensure our risks are recorded and effectively managed. This approach is shown in Figure 2 and described in the four sections below. Figure 2 – Four Steps to Managing Risk 1. Identifying risks 2. Assessing risks 3. Managing and controlling risks 4. Monitor and review risks Risk Management – A Quick Guide
Page 13
9 Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 To identify risks, think through the things that could prevent or hinder your team from achieving its business objectives. There are three parts to a risk – an event that has a consequence that leads to an impact on our objectives. Typical risk phrasing could be: Loss of… Failure of….. Failure to... leads to …... results in…… Lack of… Development of… Opportunity for You will also need to identify whether the risk is: • Strategic: risks that are significant scale and will impact on the reputation and performance of the IJB and parent organisations as a whole and in particular the IJB’s ability to deliver on strategic objectives. • Operational: risks specific to the delivery of individual services/service performance/project. Residual/Net risk = the level of risk remaining after managing it through treatment and/or control measures. To identify the Residual/Net Risk we simply identify the consequence score from the appropriate domain listed in Table 2 after we have identified the control measure. We then multiple the consequence score by the likelihood of the event occurring. The likelihood score is taken from the matrix at Table 3. Multiplying the consequence x likelihood then provides us with the Residual Risk. The Residual risk score helps to make decisions about the significance of risks to the IJB and how they will be managed, the controls required and the treatment of the risk. This can be found in Table 4. 1. Identifying risks 2. Assessing risks
Page 14
Version No. 3.0 Date Effective: 17 June 2022 Review Date: 18 June 2025 SEVERITY CONSEQUENCE MATRIX - Description and definition of the CONSEQUENCE / IMPACT of the risk should it occur (these are a guide) Severity “Domains” 1 Insignificant 2 Minor 3 Moderate 4 Major 5 Extreme Objectives and projects Barely noticeable reduction in scope / quality / schedule Minor reduction in scope / quality / schedule Reduction in scope or quality, project objectives or schedule. Significant reduction in ability to meet project objectives or schedule. Inability to meet project objectives, reputation of the organisation seriously damaged and failure to appropriately manage finances. Injury (physical and psychological) to patients/staff. Adverse event leading to minor injury not requiring first aid. Minor injury or illness, first-aid treatment needed. No staff absence required. Significant injury requiring medical treatment and/or counselling. Major injuries or long-term incapacity/ disability (loss of limb), requiring medical treatment and/or counselling. Incident leading to death or major permanent incapacity. Patient experience / outcome Reduced quality of patient experience / clinical outcome not directly related to delivery of clinical care. Unsatisfactory patient experience / clinical outcome directly related to care provision – readily resolvable Unsatisfactory patient experience / clinical outcome, short term effects – expect recovery < 1Wk Unsatisfactory patient experience / clinical outcome, long term effects - expect recovery > 1Wk Unsatisfactory patient experience / clinical outcome continued ongoing long-term effects. Complaints / claims Locally resolved complaint Justified complaint peripheral to clinical care Below excess claim. Justified complaint involving lack of appropriate care. Claim above excess level. Multiple justified complaints. Multiple claims or single major claim. Staffing and competence Short term low staffing level (< 1 day), where there is no disruption to patient care. Ongoing low staffing level results in minor reduction in quality of patient care Minor error due to ineffective training / implementation of training. Late delivery of key objective / service due to lack of staff. Moderate error due to ineffective training / implementation of training. Ongoing problems with staffing levels Uncertain delivery of key objective / service due to lack of staff. Major error due to ineffective training / implementation of training. Non delivery of key objective / service due to lack of staff. Loss of key staff. Critical error due to insufficient training / implementation of training. Service / business interruption Interruption in a service which does not impact on the delivery of patient care or the ability to Short term disruption to service with minor impact on patient care. Some disruption in service with unacceptable impact on patient care. Sustained loss of service which has serious impact on delivery of patient care resulting in major Permanent loss of core service or facility.
Page 15
Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 continue to provide service Temporary loss of ability to provide service. contingency plans being invoked. Disruption to facility leading to significant “knock on” effect. Financial Negligible organisational financial loss (£< 1k). Minor organisational financial loss (£1-10k). Significant organisational financial loss (£10-100k). Major organisational financial loss (£100k-1m). Severe organisational financial loss (£>1m). Inspection / assessment / audit Small number of recommendations which focus on minor quality improvement issues. Minor recommendations made which can be addressed by low level of management action. Challenging recommendations but can be addressed with appropriate action plan. Enforcement Action. Low rating. Critical report. Prosecution. Zero Rating. Severely critical report. Adverse publicity / reputation No media coverage, little effect on staff morale. Local Media – short term. Minor effect on staff morale / public attitudes. Local Media – long term. Impact on staff morale and public perception of the organisation. National Media (< 3 days). Public confidence in the organisation undermined. Usage of services affected. National Media (> 3 days). MP / MSP Concern (Questions in Parliament). Organisational / Personal Security, and Equipment Damage, loss, theft (£< 1k). Damage, loss, theft (£1-10k). Damage, loss, theft (£10-100k). Damage, loss, theft (£100k-1m). Damage, loss, theft (£>1m). Table 2 – Consequence/Impact Matrix Likelihood 1 Remote 2 Unlikely 3 Possible 4 Likely 5 Almost Certain Probability Will only occur in exceptional circumstances. Unlikely to occur but definite potential exists. Reasonable chance of occurring – has happened before on occasions. Likely to occur – strong possibility. The event will occur in most circumstances. Table 3 – Likelihood Matrix Risk Rating
Page 16
Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 LIKELIHOOD SEVERITY 1 Insignificant 2 Minor 3 Moderate 4 Major 5 Extreme 5 Almost Certain 5 10 15 20 25 4 Likely 4 8 12 16 20 3 Possible 3 6 9 12 15 2 Unlikely 2 4 6 8 10 1 Remote 1 2 3 4 5 Table 4 – Risk Rating Table 5 – How Risks should be managed Level of Risk Risk How the risk should be managed Very High (20-25) Immediate Action Required Intolerable Requires active management to manage down and maintain the exposure at an acceptable level. Escalate upwards. The activity or process should not be started or allowed to continue until the risk level has been reduced. While the control measures selected should be cost-effective, legally there is an absolute duty to reduce the risk. Review every 3 months. High (10-16) Immediate Action Required Unacceptable Contingency plans may suffice together with early warning mechanisms to detect any deviation from the profile. Escalate upwards. If a new activity or process, it should not be started until the risk has been reduced. Considerable resources may have to be allocated to reduce the risk. Where the risk involves an existing activity or process, the problem should normally be remedied within one to three months. Review every 6 months. Moderate (4-9) Action Required Efforts should be made to reduce the risk, but the cost of reduction should be carefully measured and limited. Risk reduction measures should normally be implemented within three to six months. Re-assess frequently Low (1-3) Acceptable No further preventative action is necessary, but consideration should be given to more cost-effective solutions or improvements that impose no additional cost burden. Monitoring is required to ensure that the controls are maintained. Review periodically to ensure conditions have not changed.
Page 17
Version No. 3.0 Date Effective: 17 June 2022 Review Date: 18 June 2025 THE FOUR T’s The level of the inherent risk will help determine the best treatment for a risk, whether strategic or operational. Once the type of risk has been determined, consideration must be given to the most appropriate course of action to treat the risk, an action plan will be required to be drawn up and implemented. The rating and prioritisation of the risk will determine the pace with which the risk action plan should be implemented and at which level of the organisation the risk needs to be reported. Tolerating A risk may be tolerated where: • the risk is effectively mitigated by internal controls, even if it is a high risk • the risk cannot be mitigated cost effectively • the risk opens up greater benefits These risks must be monitored, and contingency plans should be put in place in case the risk occurs. Treating This is the most widely used approach. The purpose of treating a risk is to continue with the activity which gives rise to the risk, but to bring the risk to an acceptable level by taking action to control it in some way through either: • containment actions (these lessen the likelihood or consequences of a risk and are applied before the risk materialises) or • contingency actions (these are put into action after the risk has happened, thus reducing the impact. These must be pre-planned) Terminating Doing things differently and therefore removing the risk. This is particularly important in terms of project risk but is often severely limited in terms of the strategic risks of an organisation. Transfer Transferring some aspects of the risk to a third party, e.g., via insurance, or by paying a third party to take the risk in another way. This option is particularly good for mitigating financial risks, or risks to assets. However, it is a limited option. Table 6 – The Four T’s CONTROLS Any action, procedure or operation undertaken to either contain a risk to an acceptable level (the impact), or to reduce the likelihood. Where future actions are planned these should have a date by which they will be implemented. REPORTING RISK Nothing stays the same forever. By talking to your staff and monitoring incident rates and control measures, you will be able to judge whether your risk control measures are effective. Managers and staff must be given responsibility to oversee the process and develop reporting procedures, discussing and helping to implement solutions, as well as monitoring the solutions for effectiveness. Risks should be reviewed regularly to ensure that the risk has not changed and that no further control measures are needed. A risk should also be reviewed if any changes occur that may increase the risk of an adverse event occurring. 3. Managing and controlling risks 4. Monitor and Review Risks
Page 18
Document Title: Risk Management Policy and Strategy Owner: Chief Officer Version No. V3 Superseded Version: V2 Date Effective: 17 June 2022 Review Date: 18 June 2025 There is no legal time frame for when you should review your risk assessment. The IJB has adopted an interactive process with discretion when a review is deemed necessary. The risk assessment and register are a live working document and, as your business experiences change, this information should be recorded and updated. As a guide, it is recommended that risk assessments be reviewed as a minimum on an annual basis.