Risk Management Update and Corporate Risk Register 2022-23
North Lanarkshire Council · 8 September 2022
Back to Audit and Scrutiny Panel — 8 September 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref: KA/CMT/Sept22 Date 08/09/22 Risk management update and corporate risk register 2022-23 From Ken Adamson, Head of Audit & Risk E-mail adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary This report provides members with a general update on key risk management developments with a particular focus on the results of the recent annual review of the corporate risk register. The report also contains a proposed timetable for future reporting on key corporate risks to the Panel. The corporate risk register is reviewed annually to ensure completeness and continuing alignment to the council’s strategic objectives, The Plan for North Lanarkshire and the associated Programme of Work. The purpose of this report is to update the Panel on the results of that process and to present the 2022-23 corporate risk register as determined by CMT. To support the review, the risk team prepared a horizon scanning document (Appendix 4) which was used to support consideration of the key strategic and operational risks facing the Council. The risk team also engaged with Services to consider whether any risks within Service-level risk registers merited escalation to the corporate risk register and undertook informal comparisons with other local authorities’ corporate risk registers to inform the process. Members should note that all corporate risks identified and agreed as meriting inclusion in the corporate risk register are subject to regular monitoring and review by relevant senior management and periodic review/consideration of individual risks by both the CMT and the Panel in line with the Council’s Risk Management Strategy and their respective governance roles. Overall, although there are some changes in individual risk scores, the corporate risk register for 2022-23 is substantively unchanged from the previous year. The most significant changes include a widening in scope of the previous ‘Asset Management’ corporate risk to better reflect how this and other key Programmes of Work align and link together in supporting the implementation of the Council’s target operating model and increasing clarity over the potential impacts of the National Care Service proposals following publication of the draft legislation. Other changes are noted in the body of the report. Recommendations The Panel is asked to consider the contents of the report and to: (1) note the agreed corporate risk register for 2022/23 at Appendix 1 which incorporates the range of proposed changes outlined in Section 2 of the report; (2) approve the proposed schedule (at Appendix 3) for reporting on corporate risks to future meetings of the Panel; and (3) note the proposal to carry out a further review of the corporate risk register in late-2022 as described at para 2.28 including the addition of top risks from Service risk registers.
Page 2
1. Background 1.1 The Council’s Risk Management Strategy requires that the corporate risk register is refreshed on an annual basis; led by the Corporate Risk Team, working with the Risk Management Corporate Working Group (RMCWG) on behalf of, and in consultation with, the Corporate Management Team. In addition, each Service is required to maintain its own risk register in respect of the operational service risks within their areas of responsibility. 1.2 In addition to considering the wider environment within which the Council operates, each year the corporate risk register is also reviewed for completeness and relevance to the council’s strategic objectives, and alignment with The Plan for North Lanarkshire and the associated Programme of Work. 1.3 This year’s annual review exercise has recently been undertaken on behalf of CMT. This has involved discussion with members of the RMCWG, as well as directly with Heads of Service, to consider potential issues arising from individual Service risk registers. Informal external benchmarking with corporate risk registers of other councils has also been carried out. Most importantly the review has been informed by, and considered against, The Plan for North Lanarkshire and the revised ‘Programme of Work for 2022/23’ approved by Policy & Strategy Committee in March 2022. 1.4 The environment within which the council operates and provides services continues to be dynamic and the proposed corporate risk register must continually evolve in order to keep pace with and accurately reflect, the ongoing challenges facing the Council. To aid this process, the Corporate Risk Team prepared a ‘horizon scanning’ paper to support CMT’s considerations/discussions on risks associated with the council’s future direction and strategic planning considerations. The paper, attached at Appendix 4, is intended to highlight risks and issues relevant to the environment within which the Council operates. The paper can also be used to generate discussion and inform thinking in relation to the preparation and review of individual Service Risk Registers. It is proposed that such horizon scanning will form a key part of the corporate risk register annual review exercises going forward. 1.5 This report presents the outcome from this year’s corporate risk register review process and allows the Panel to note the corporate risk register for 2022-23 as outlined in the table at Appendix 1. 1.6 Members will note a change of layout of this year’s corporate risk register. The opportunity has been taken to present the register in two sections; the first relating to those corporate risks which are more ‘day to day’ or operational in nature and the second relating to those risks which are more strategic and/or longer-term in nature. Although there is not always a clear distinction between the two, it is hoped that this will assist/inform the review process in future. 2. Report 2.1 The previous corporate risk register approved for 2021-22 contained 25 risks as outlined in the table at Appendix 1. Risks contained within the register have been subject to ongoing monitoring and review throughout the year, with regular risk reporting to CMT and Audit & Scrutiny Panel both on the overall register, and with detail on individual risks being reported by relevant Risk Leads. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 3
2.2 Currently there are 21 risks classified as ‘live’ with completed risk documentation, and 4 risks classified as ‘draft’ where relevant documentation is currently being finalised. 2.3 The definition of a corporate risk is ‘those risks which can impact the Council in achieving its priorities and stated objectives or are more strategic in nature and require corporate oversight. For example, such risks may have the potential to impact many Services, and/or can impact significantly on the Council in terms of financial costs and reputational damage. The Corporate Risk Register will reflect an amalgamated position of Service-level risks and may also include significant Service-level risks which have been escalated for attention at a strategic level.’ 2.4 A number of methods have been used and information sources reviewed to stimulate a thorough approach to the corporate risk register review process including: • Review of the Programme of Work for 2022-23 considering whether risks in relation to key planned Programme of Work activities are adequately reflected within existing corporate, service and/or project risk registers; • Heads of Service were asked to consider whether any changes to the corporate risk register were deemed necessary arising from the 2022-23 Programme of Work. • Services were asked to highlight any key risks within Service risk registers not already reflected that might merit consideration for inclusion in the corporate risk register going forward; • Informal comparisons/benchmarking was done with other local authorities’ corporate risk registers, to help inform the review process and to identify any relevant issues which may have been overlooked; and • The corporate risk team undertook a ‘horizon scanning’ exercise on behalf of CMT to support its discussions on the council’s future direction and strategic planning considerations. This included examination of a range of external sources including public sector risk partner Zurich Municipal’s white paper ‘Rising to the Challenge’ focussing on the future of the public and voluntary sectors, as well as relevant materials from the National Audit Office, Audit Scotland, Deloitte and HM Treasury. 2.5 The corporate risk register should be reflective of what the Council is seeking to achieve at a strategic level with risks relating to key projects or programmes captured. Our review of the approved Programme of Work for 2022-23 suggests that risks in relation to key planned activities being undertaken are largely already captured either at corporate, service or project level and controls/actions that will help mitigate some of those risks are largely captured, although it was identified that there is scope to better reflect the interdependencies between certain key projects and workstreams and how failure to recognise this could impact the achievement of certain key objectives. 2.6 A ‘sense-check’ or informal benchmark review of other council’s corporate risk registers confirms that the content of the Council’s corporate risk register remains valid and comprehensive, and broadly consistent with other council’s risk registers. 2.7 Changes agreed to the corporate risk register by CMT as a result of the review process are detailed throughout the remainder of this report. Review of the 2021-22 corporate risk register 2.8 Most of the existing risks contained within the 2021-22 corporate risk register remain relevant and are included in the agreed 2022-23 version. Existing risks are subject to regular review by the relevant Risk Lead and associated governance groups. 2.9 Following a recent review, Risk RIS0000019: Information Security & Information Governance has increased in rating from 16-HIGH to 20-HIGH. Whilst good progress continues to be made on the implementation and embedding of controls in relation to this risk, the residual risk likelihood has been raised again to 5 recognising the current increased external threats arising from the current geopolitical situation which
Page 4
increases the likelihood of a cyber-attack. There is ongoing monitoring of this risk and the relevant controls and actions by the Information Risk & Security Team and the Head of Business & Digital, as the lead for this corporate risk. The ‘Human Resources’ corporate risk has also increased from 12-MEDIUM to 16-HIGH reflective of current labour market challenges in relation to recruitment and retention, particularly of some key professions. 2.10 Following the local government elections in May 2022, it is recognised that the resultant changes in the political landscape and governance arrangements within the council, are likely to have a bearing on a number of existing corporate risks. Management has therefore agreed to review risks RIS0000021: Managing Strategic Change and RIS0000256: Governance, Leadership & Decision Making at an early opportunity to reflect any resulting impacts on the nature and significance of these risks and how these issues are managed. Any other associated impacts on the council’s overall risk profile will also be considered as part of these reviews. As risks with significant potential influence on all areas of council activity and decision making, these have been added at a relatively early stage to the proposed timetable for reviewing/reporting on corporate risks to CMT and the Panel at Appendix 3. Existing risks remaining but with an agreed change of focus/reframing 2.11 As part of our engagement with Heads of Service, the Head of Planning and Regeneration raised Risk RIS0000259: Implementation of ERDP for possible reframing to make the risk and its scope more focused. Recognising the long-tail nature of many of the programme/projects and the range and diverse nature of the activities and PoW items that make up the ERDP, discussions are currently ongoing with relevant senior management to revise the scope of this risk. The intention is to make it more specific and relevant to the shorter-term objectives included within the Programmes of Work, while ensuring it articulates current and anticipated key challenges. 2.12 CMT had previously agreed that the ‘Asset Management’ risk should remain on the corporate risk register, but there has been some challenge in agreeing exactly how this risk should be framed. Recognising the strategic implications of the asset rationalisation programme and its links with other key Programmes of Work, it has now been agreed by CMT that the risk scope is expanded to be described as: “Ensuring resources (workforce, digital and assets) and service delivery are fully aligned to support the successful implementation of the Council’s future operating model”, and risk description reframed as “There is a risk that the council is unable to successfully implement Phase 1 of its Future Operating Model in having a flexible and empowered workforce, delivering efficient collaborative services from an optimised modern asset base”. 2.13 Many different workstreams need to effectively align and dovetail to enable the Council to successfully deliver the vision for the new ways of working and provide a solid foundation for future phases of organisational and transformational change. There are also issues relating to financial resources and progress regarding prioritisation and integration that will also need to be aligned. As a newly framed and important risk, this has been added at a relatively early stage to the proposed timetable for reviewing/reporting on corporate risks to CMT and the Panel at Appendix 3. New risks added to the corporate risk register 2.14 A new risk in relation to the impact of ‘Supply Chain’ disruptions is currently being finalised to reflect the position across the Council of its organisational ability to anticipate and respond to changes and disruption to supply chains, including non- availability/delay of goods and services as well as resulting potential impacts on costs and robustness of contract supplier management processes. Focus is being given to ensure that this aligns with planned actions from a Corporate Procurement perspective in relation to the agreed Procurement Improvement Plan, capturing those actions which will have a positive impact on the council’s resilience in this area and on the management of this risk in terms of contract supplier management. As a new risk, this
Page 5
has been included at a relatively early stage within the proposed timetable for reporting on corporate risks to CMT and the Panel at Appendix 3. A separate report from management on the impacts of associated inflationary pressures on the Council and how these might be responded to is currently being prepared and is expected to be submitted to elected members in due course. 2.15 The Panel should note that the two new risks that were previously agreed by CMT for inclusion on the corporate register ‘Impact of proposals in respect of the National Care Service’ and ‘Educational attainment gap (including learning loss arising from Covid- 19)’ are still under development. The risk team continues to work with Senior Management to finalise risk documentation and scoring, the results of this will be reported to CMT and the Panel as soon as these are available. The National Care Service proposals are likely to have significant potential impacts on the Council and although there remains considerable uncertainty over some of the details of how the Scottish Government’s policy ambitions will be progressed, a separate report setting out management’s current understanding of the risks and issues for the Council arising from the relevant draft legislation is currently being prepared and is expected to be reported to members in due course. 2.16 In anticipation of the completion of risk documentation and assessment of these new risks, these risks have also been added to the proposed timetable for reporting on corporate risks to CMT and the Panel by Risk Leads at Appendix 3. Risks agreed for escalation and/or de-escalation from Service risk registers Escalation 2.17 CMT has recently agreed that RIS000008: Scottish Child Abuse Inquiry be escalated from the service risk register for inclusion in the corporate risk register to enable formal consideration and oversight of increased activity in this area. This was particularly in relation to current challenges around organisational capacity to respond to an increasing number and complexity of requests for information and associated financial and reputational risks. The Corporate Risk Team will work with relevant management to review and refresh risk assessment documentation, linking with the Corporate Historical Abuse Working Group prior to reporting back to CMT with an updated risk position. As a newly escalated risk, this has also been added to the proposed timetable for reporting on corporate risks to CMT by Risk Leads. De-escalation 2.18 It has been agreed to de-escalate RIS0000461: Administration of Elections to the Chief Executive’ Service risk register for ongoing monitoring at Service level, with the expectation that it can be escalated again for CMT oversight in advance of the next council-wide election event (which is presently scheduled to be the next UK General Election due in 2024). 2.19 It was also agreed to de-escalate RIS00000325: Pandemic Illness: Covid-19 to the Enterprise & Communities Service risk register, for ongoing monitoring as part of the Council’s corporate resilience arrangements, with the expectation that should there be a material change in circumstances and/or public health messaging, the risk may be escalated again to support CMT in decision-making related to any possible future increase in this risk. 2.20 With these changes, it should be noted that the overall net effect is that the agreed risk register has 24 risks, 20 of which are ‘Live’ and fully documented and 4 of which are still being finalised. 2.21 Ongoing monitoring and review of these risks ensures that planned actions to mitigate risks are being progressed, as well as ensuring there is consideration of whether controls are still in place and having the desired effect in managing the risk. Further detail on the management of each risk is available within the accompanying deep dive risk assessment documentation.
Page 6
Other risk management developments 2.22 The Panel should note that the Corporate Risk Team continues to actively participate in the ongoing review of the corporate project management methodology, with a key focus on ensuring that robust risk management practice is embedded and applied appropriately within the management of projects, and crucially that there are mechanisms for recognising and highlighting risks and issues between projects that are inter-related and/or have interdependencies. 2.23 The Corporate Risk Team also continues to actively support the application of risk management in a number of key corporate projects including most recently the Shared Campus, Asset Rationalisation and Climate Change projects including supporting Project Boards’ consideration of risk. 2.24 The planned review of the existing Corporate Risk Management Strategy will commence shortly and be carried out in accordance with the Strategic Policy Framework Guidance, with reporting back to CMT and Committee for approval scheduled for early-2023. 2.25 Internal Audit recently concluded work on the Council’s risk management arrangements which included a review of both corporate and Services’ arrangements for ensuring that all significant risks are identified, evaluated and controlled, that risk registers have been prepared and are kept up-to-date, and that appropriate arrangements are in place to review/monitor and report on risk. 2.26 The report, details of which can be found as part of the Internal Audit progress report (a separate agenda item at this meeting), categorised the audit as offering ‘reasonable assurance’ meaning that Internal Audit considered that the Council’s risk management arrangements have continued to improve and embed since their last review, that they were generally satisfied that these arrangements are being actively supported and promoted by senior management at both corporate and service level, and that risk management contributes towards the achievement of corporate objectives. 2.27 Internal Audit also reported that they were satisfied that there are adequate procedures in place at both corporate and service levels for identifying and prioritising risks and identifying appropriate action to mitigate/manage those risks. A number of areas for improvement were identified and management has committed to a range of actions to address these. These included that replacement and/or new corporate risks need to be documented and assessed in line with agreed timescales, improvements are required in respect of training on risk and a framework for monitoring compliance with the Risk Management Strategy needs to be developed and implemented to better facilitate assessment and overview of the adequacy and effectiveness of risk management arrangements within Services. Further review of the corporate risk register 2.28 In order to provide further update to CMT and the Panel on completion of ‘draft’ risks and resulting outcome of risk assessments, it is proposed that a further review of the corporate risk register is carried out in December 2022 and reported to CMT and the Panel. It is also proposed at that time to supplement the Corporate/Strategic risk register information for the first time with a summary of key Service risks from service risk registers. Not only will this allow CMT and the Panel to gain a clearer understanding and awareness of key service risks, but it will have the added value of ensuring better alignment between key corporate risks and issues, with the content of individual Service risk registers.
Page 7
3. Measures of success 3.1 The corporate risk management team will continue to report quarterly to CMT and the Audit and Scrutiny Panel providing an overview of key developments in risk management and updating on progress in respect of planned improvements to the Council’s risk management arrangements. 3.2 The adequacy and effectiveness of the Council’s risk management arrangements will be independently and regularly reviewed by Internal Audit, who will report directly on the results of that work to the Audit and Scrutiny Panel. 3.3 Effective risk management arrangements assist the Council in achieving planned outcomes and/or help the Council mitigate the impacts of adverse events. 4. Supporting documentation Appendix 1: 2022-23 corporate risk register Appendix 2: Risk scoring matrix and descriptors Appendix 3: Proposed timetable for reporting of corporate risks to CMT and ASP Appendix 4: Current strategic risks and issues facing the Council Ken Adamson Head of Audit and Risk
Page 8
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective risk management arrangements including the identification, assessment, management and oversight of relevant risks will increase the likelihood of the Council achieving its ambitions and plans by more effectively mitigating potential threats to planned outcomes. It also contributes to effective management of risks relating to all service and operational areas.
Page 9
Appendix 1: 2022-23 corporate risk register CORPORATE RISKS (Operational) Likelihood Impact Rating Evaluation 1. Information Security and Information Governance 5 4 20 High 2. ICT operational capability 4 4 16 High 3. Public Protection 4 4 16 High 4. Human Resources 3 4 16 High 5. Health and Safety 5 3 15 High 6. Business continuity planning 5 3 15 High 7. Terrorism 3 5 15 High 8. Governance, Leadership and Decision-Making 3 4 12 Medium 9. Procurement risk 3 4 12 Medium 10. Resilience planning 2 5 10 Medium 11. Serious organised crime, fraud and corruption 3 3 9 Medium 12. Supply Chain risk (new) To be confirmed To be confirmed To be confirmed To be confirmed 13. Scottish Child Abuse Inquiry - (escalated) To be confirmed To be confirmed To be confirmed To be confirmed CORPORATE RISKS (Strategic) Likelihood Impact Rating Proximity 14. Tackling Poverty 5 4 20 High 15. Climate Change 4 4 16 High 16. Implementation of Economic Regeneration Development Plan 3 5 15 High 17. Financial Sustainability 3 5 15 High 18. Enterprise Project 3 4 12 Medium 19. Managing strategic change 3 4 12 Medium 20. Digital and IT strategy 3 3 9 Medium 21. Engagement and consultation 3 3 9 Medium 22. Ensuring resources (workforce, digital and assets) and service delivery are fully aligned to support the successful implementation of the Council’s future operating model. (NB. Replaces asset management risk) To be confirmed To be confirmed To be confirmed To be confirmed 23. Impact of National Care Service (NB. Replaces IJB risk) To be confirmed To be confirmed To be confirmed To be confirmed 24. Improving Educational Outcomes To be confirmed To be confirmed To be confirmed To be confirmed RISKS DE-ESCALATED TO SERVICE RISK REGISTER 25. Administration of Elections 3 4 12 Medium 26. Pandemic Illness: Covid-19 3 3 9 Medium
Page 10
APPENDIX 2: LIKELIHOOD / IMPACT DESCRIPTORS AND RISK MATRIX Likelihood Descriptors: Score Probability of occurrence Description 5 Over 90% Almost certain to occur within 12 months 4 61-90% Likely to occur within 12 months 3 31-60% Possible that it may occur within 12 months 2 11 - 30% Unlikely to occur within 12 months 1 10% or less Rare that it would occur within 12 months Impact Descriptors: Score Description of impact On Service Objectives Financial On people On time to recover On reputation 5 Catastrophic Unable to function, inability to fulfil obligations Severe financial loss (over 25% of budget) Death Serious – in excess of 2 years to recover to pre- event position Highly damaging, severe loss of public confidence 4 Major Significant impact on service objectives Major financial loss (between 10% and 25% of budget) Extensive injury, major permanent harm Major – between 1 and 2 years to recover to pre-event position Major adverse publicity, major loss of confidence 3 Moderate Moderate impact on service objectives Significant financial loss (between 2.5% and 10% of budget) Medical treatment required, semi- permanent harm up to one year Considerable – between 6 months to 1 year to recover to pre- event position Some adverse publicity, legal implications 2 Minor Minor impact on service objectives Moderate financial loss (between 1% and 2.5% of budget) First aid treatment, non- permanent harm up to 1 month Some – 2 to 6 months to recover to pre-event position Short-term public embarrassment and no damage to reputation 1 Insignificant Minimal impact, no service disruption Minimal loss (up to 1% of budget) No obvious harm/injury Minimal – up to 2 months to recover No interest to the media, internal only. Risk Matrix: Likelihood 5 - Almost certain 5 10 15 20 25 4 - Likely 4 8 12 16 20 3 - Possible 3 6 9 12 15 2 - Unlikely 2 4 6 8 10 1 - Rare 1 2 3 4 5 1 - Insignificant 2 - Minor 3 - Moderate 4 - Major 5 - Catastrophic Impact Risk Rating Insignificant 1-3 Low 4-6 Medium 8-12 High 15-25
Page 11
Appendix 3: Proposed timetable for reporting on corporate risks to CMT/ASP The future programme post-February 2023 will be considered as part of the proposed review of the corporate risk register scheduled for December 2022. Risk Lead report on CMT A&SP 1. Ensuring resources (workforce, digital and assets) and service delivery are fully aligned to support the successful implementation of the Council’s future target operating model (replaces asset management risk) September 2022 November 2022 2. Supply chain risk October 2022 November 2022 3. Governance, leadership and decision- making November 2022 November 2022 4. Impact of National Care Service proposals December 2022 February 2023 5. Managing strategic change January 2023 February 2023 6. Improving educational outcomes February 2023 February 2023 7. Scottish Child Abuse Inquiry March 2023 May 2023
Page 12
Appendix 4 - Current strategic risks and issues facing the Council This note has been prepared by the Corporate Risk Team (in March 2022) to support CMT discussions on the Council’s future direction and strategic planning considerations and represents an informed horizon scanning of the environment within which the Council will operate. It does not highlight all those risks currently on the corporate risk register, particularly those that relate to the management of day-to-day operations of the Council, but rather attempts to highlight where current corporate risks relate to the broad strategic themes highlighted in the document. 1. Constitutional uncertainty Links to existing corporate risks: ‘Managing strategic change’ and ‘Impact of National Care Service’ • Potential for an independence referendum to be held during current parliamentary session. • Following Brexit, it remains unclear how the UK internal market (across England, Scotland, Wales, and Northern Ireland) will operate and how some aspects of the existing devolution structures will operate. • The process of implementing the Scotland Act 2016 remains incomplete (VAT assignment and full adoption of social security powers). The fiscal framework is due for review in 2022. • Uncertainty surrounding the potential impact of all of the above, and proposals relating to National Care Service and the potential impact of moves towards greater national or regional collaboration in Education on the future composition and funding of Scottish local government. 2. Economic challenges Links to existing corporate risks: ‘Implementation of ERDP’ ‘Digital and IT Strategy’ ‘Educational attainment’ and ‘Climate change’ and ‘Tackling Poverty • The pandemic has resulted in an economic downturn. Some sectors of the economy may be permanently affected. The nature and timing of economic recovery remains unclear. Establishing a more digital, more inclusive economy will require time and significant investment in skills. The economy will have to reshape to enable climate change objectives to be met. Economic/inflationary pressures on household incomes may drive greater demand for public services. • Scotland’s fiscal framework means that public sector budgets are now more closely tied to economic performance (and Scotland’s performance relative to the rest of the UK) than at any time since devolution in 1999. • The short and long-term economic effects of exit from the European Union (due to changes in access to markets and migration patterns) remain to be seen. • Uncertainty around short-term impacts of geopolitical situation with Russia and Ukraine and potential longer-term impacts on wider supply chains/increased focus on supply chain resilience with consequential potential impacts on rising costs, availability etc.
Page 13
Appendix 4 - Current strategic risks and issues facing the Council (continued) 3. Financial sustainability Links to existing corporate risks: ‘Financial sustainability’ • A considerable proportion of the Scottish public sector budget is spent on the NHS and social care. Along with the effects of the pandemic, demographic change and medical advances mean that despite being prioritised in successive Scottish Government budgets (at the expense of local government) the pressure on these budgets is already acute and appears insatiable. Some NHS boards have already seen overspends, despite the NHS budget having grown in real terms. • The public sector already has many long-term financial commitments (pensions, PFI/PPP/NPD payments) that extend decades into the future. This constrains its financial flexibility. • Prior to the pandemic, there were already concerns about the financial sustainability of certain parts of the public sector in their current form including local government and policing. The pandemic has focused the public sector’s attention on short-term priorities. The need and challenges for medium and long-term financial planning to ensure future planned activities are compatible with financial sustainability remains. 4. Addressing inequalities Links to existing corporate risks: ‘Tackling Poverty’, Implementation of ERDP’ and ‘Educational Attainment’ • There is still a significant amount of progress to be made to reduce inequalities. Areas affected include wealth, health and wellbeing and education. These inequalities affect diverse communities and groups (including women and girls, BAME people, older people, disabled people etc.) often in complex and interacting ways. • There are profound geographical inequalities both across Scotland and within individual Council areas. Demographic changes (the aging population and movement of population from some parts of Scotland to others) may alter these patterns. • There is a need to capture users’ perspectives and enable communities to have greater power and influence over what matters to them through increased community engagement and meaningful participation in the planning/design and delivery of public services. 5. Performance and innovation Links to existing corporate risks: ‘‘Governance, leadership and decision-making’ ‘Information security and governance’, ICT operational capability’, ‘Digital and IT strategy’ • Ten years since the Christie report, there is still limited evidence of a significant shift towards preventive spending. • Mounting financial pressures are starting to have an impact on how well some public services are performing. This may affect delivery of the outcomes in the National Performance Framework, such as reducing educational inequalities. The pandemic has exacerbated this, created backlogs and reduced access to some public services and affected systems to monitor performance. • The integration of health and social care remains a work in progress with considerable cultural, organisational, and financial challenges. The proposals surrounding the creation of a National Care Service have the potential to create significant challenges and strategic, financial, and operational risks to the Council’s current operations and ability to deliver against its wider ambitions. • The pandemic has accelerated the shift to greater digital delivery of public services, but true digital transformation remains a significant challenge to deliver and generates risks around capacity, digital exclusion, cybersecurity, and fraud.
Page 14
Appendix 4 - Current strategic risks and issues facing the Council (continued) 6. Leadership, workforce, and governance Links to existing corporate risks: ‘Governance, leadership and decision-making’, ‘Human Resources’ ‘Managing strategic change’, ‘Engagement and consultation’) • Leadership roles are increasingly difficult to fill in parts of the public sector with increased turnover/vacancies at senior (chief executive, director) levels. • To secure long-term outcomes, collaborative leadership across multiple organisations and sectors is essential. Achieving this remains challenging when existing public sector structures and systems of incentives and accountability remain siloed. • An ageing population, increasing demands for Council services, relatively inflexible remuneration arrangements and a smaller working age population presents real challenges for local authorities to ensure they remain an attractive option for younger workers and can recruit and retain sufficient staff with the right skills and attributes. Also increased focus on ensuring our employees reflect the diversity of our local communities. • The shift to digital technology and the expansion in the use of data and artificial intelligence demands greater attention to digital governance to ensure that ethical, privacy and equalities and human rights perspectives are carefully considered. 7. Other current and potential future corporate risks with strategic considerations • Public Protection: always a high-risk and high-profile issue. Increased risks arising during the pandemic and from the economic challenges facing many families and communities will likely result in continuing pressures. • Enterprise Project: refocused and narrower than originally envisaged but still a significant project which will need to be successfully delivered to underpin key aspects of service delivery and to contribute to the achievement of many of the Council’s wider ambitions. • Place-making: central to the Council’s ambitions and links the Council’s future operating model and associated asset requirements to the wider development and delivery of the Town Centre Visions designed to create vibrant and sustainable towns across North Lanarkshire. • Working/collaborating with partners and other stakeholders – the Council increasingly needs to work in partnership to address the complex challenges facing our towns and communities. This can be challenging and also requires us to rely on the willingness, capacity and ability of third parties to positively engage. • Organisational resilience and agility – while the resilience of the organisation has been well-tested over the last two years, there remains a risk that our longer-term ability to anticipate and respond to external factors is impaired, for example, as a result of further financial and workforce pressures. The maturity and effectiveness of key enablers such as risk management, project management and contract management will directly affect how well we can, identify, anticipate and respond to certain challenges.
Page 15
Summary assessment of the potential impact and timing of identified strategic risks and whether these are currently increasing, stable or decreasing Risk Timeframe Impacts Risk currently increasing, stable or decreasing? Impacts of constitutional uncertainties (future development of the devolution settlement and potential independence referendum) Ongoing / uncertain Potentially high Increasing – the medium-term political context within which the Council operates continues to be fluid and uncertain. Impacts of Scottish Government policies such as the proposed National Care Service and potential future education reform Short-term 1-3 years Potentially high Increasing – the NCS proposals creates significant operational, financial and strategic risks for the Council and along with the wider direction of travel of other SG policies suggests uncertainty over, and a possible future review of, the current structure and composition of Scottish local government. Economic challenges Immediate High Increasing – the post-Covid economic environment combined with current inflationary/cost of living pressures has and will continue to significantly impact North Lanarkshire and its communities and is likely to make the Council’s aspirations in this area more challenging to achieve. Financial sustainability Immediate and likely to be ongoing High Currently stable but current/future pressures on NHS and impacts on future SG budgets of the use of devolved income tax powers is likely to result in increased pressures on future LG budgets. Also, significant risks arising from current inflationary pressures on Council budgets (and although initially expected to be relatively short- term, these could become more embedded). Inequalities: including wealth, health and wellbeing and education Immediate and ongoing High Increasing – Covid’s impacts have generally worsened pre-existing inequalities across all aspects (wealth, health and well-being and education) making the Council’s aspirations in this area more challenging to achieve. Performance and innovation (including digital transformation) Short-term 1-3 years Medium to High Increasing – financial challenges, changing public expectations and ongoing performance challenges are likely to require difficult decisions re-service delivery models and service redesign, testing the Council’s organisational capacity to deliver. Leadership and workforce Short-term 1-3 years Medium to High Increasing – longer-term demographic pressures have been exacerbated by Brexit and Covid impacts; existing workforce pressures have already increased and the Council faces real challenges to ensure it has the right workforce to deliver against its current and future ambitions. Increased risks arising from staff expectations that future pay awards will keep pace with current inflationary pressures. Place making – range of activities designed to create vibrant and sustainable towns across North Lanarkshire Longer term 3-5 years Medium to High Increasing - The Council’s aim to create vibrant and sustainable towns across North Lanarkshire faces considerable challenges and the economic and wider societal impacts of the pandemic have only increased the pressures on existing town centres.