Risk Management Update
North Lanarkshire Council · 16 February 2023
Back to Audit and Scrutiny Panel — 16 February 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref: KA/ASP/2023/Feb Date 16/02/23 Risk Management update From Ken Adamson, Chief Officer - Audit & Risk E-mail adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The Council continues to operate within a complex and challenging environment reflected in corporate and service risks registers. This report provides the Panel with a brief update on key risk management developments since the most recent update report to the Panel in November 2022. As well as providing an update on the Council’s corporate risk register and highlighting a selection of the more significant issues which are of current focus from a risk perspective, the report also provides an update on recent changes in internal governance arrangements and the expected impacts on how risk issues are managed and monitored by senior management. The report also confirms that the planned review of the Council’s Risk Management Strategy is now complete and a report setting out proposed changes will be submitted for approval to the Policy and Strategy meeting due to be held on 16 March 2023. Strategically significant risks of current focus remain largely unchanged from the last update and include responding to the ongoing challenges presented by current inflationary pressures and future levels of funding for local government. The Council is also fully engaged with ongoing attempts to assess and respond effectively to the likely significant impacts of the National Care Service draft legislation and associated guidance on service users, staff and the Council more generally. How the Council is responding to this latter issue is the subject of a separate report to the Panel. Significant operational risks of current focus include work to ensure the resilience of the Council’s home care service in light of ongoing pressures and increased challenges over the winter period and ongoing work relating to staffing issues, including responding to industrial action and to recruitment and retention challenges. Finally, risk issues continue to be addressed in relation to a number of significant projects and programmes of work. Recommendations The Panel is asked to consider the contents of the report and to: (1) note the current residual scores for those risks agreed for inclusion in the corporate risk register for 2022-23 at Appendix 1; (2) note the references to other topical risk issues highlighted in Section 2; and (3) note the work ongoing to further strengthen and embed risk management arrangements. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 The Council’s Risk Management Strategy requires that the corporate risk register is refreshed on an annual basis; led by the Corporate Risk Team, working with the Risk Management Corporate Working Group (RMCWG) on behalf of, and in consultation with, the Corporate Management Team (CMT). In addition, each Service is required to maintain its own risk register in respect of the operational service risks within their areas of responsibility. CMT previously approved the 2022-23 corporate risk register as outlined in the table at Appendix 1. 1.2 It is widely recognised that the environment within which the Council operates and provides services is dynamic, and corporate and service risk registers must continually evolve to keep pace with and accurately reflect, the ongoing challenges facing the Council. 1.3 The current Risk Management Strategy sets out required frequencies for the ongoing review by management of both Corporate and Service risks. 2. Report 2.1 The corporate risk register approved for 2022-23 is at Appendix 1. Risks contained within the register have been subject to ongoing monitoring and review throughout the year, with regular risk reporting to CMT and the Panel both on the overall register, and with detail on individual risks being reported by relevant Risk Leads. 2.2 The definition of a corporate risk is ‘those risks which can impact the Council in achieving its priorities and stated objectives and/or are more strategic in nature and require corporate oversight. For example, such risks may have the potential to impact many Services, and/or can impact significantly on the Council in terms of financial costs and reputational damage. The Corporate Risk Register will reflect an amalgamated position of Service-level risks and may also include significant Service-level risks which have been escalated for attention at a strategic level.’ Update on the 2022-23 corporate risk register 2.3 Since the last update to the Panel, there have been no substantive changes to the risks contained within the corporate risk register or the scores of those risks since the report to the Panel in November 2022. Additional issues currently being considered for possible future inclusion in the corporate risk register include Black Start/Power Resilience, Home Support service delivery and Home to School Transport. 2.4 Currently all bar three risks are classified as ‘live’ with completed risk documentation; the two risks classified as ‘draft’ where relevant documentation is currently being finalised are ‘Target Operating Model’ and ‘Improving Educational Outcomes’. Both risks are due to be finalised and to be able to be reported as live before the end of the financial year. The remaining risk, ‘Impact of National Care Service proposals’ is documented but remains unscored and actively under review in light of ongoing uncertainty and developments as the relevant legislative process proceeds. 2.5 Members will note at Appendix 1, that the overall corporate risk profile has changed with a notable increase in the number of risks which now sit within the ‘High’ category for residual risk rating. This is to be expected because of the complex and challenging environment in which the Council is operating, and the changing risk profile itself should be a key consideration in the planning and decision-making activities of the Council. 2.6 Generally corporate risks are being reviewed within reasonable timescales, however there can be occasions where they fall overdue and Risk Leads have been reminded of the need to contact the Corporate Risk Team promptly when e-mail reminders are received to advise that a risk is due its review. The Corporate Risk team will then assist in the facilitation and co-ordination of those reviews, and timely consideration will allow risk review frequencies to be maintained aligned to risk rating, and avoid risks becoming out of date, ensuring risks are current and reflective of the most current position.
Page 3
2.7 It had previously been proposed, with effect from this committee cycle, to supplement the Corporate/Strategic risk register information included in this report with, for the first time, a summary of key Service risks from service risk registers. However, work to do so has identified a lack of consensus on how service risks might be selected for reporting and a degree of inconsistency in the quality and content of Service risk registers. Consequently, key Service risks are not included in this report and the Risk Management Corporate Working Group continues to explore with Service Risk Champions how best to identify which Service risks will be reported to both CMT and the Panel in future risk management update reports. As part of this process, Services have also been asked to review and ensure that risk registers are comprehensive, of appropriate quality and up to date (and that this is reported to, and confirmed by, Service Management Teams as part of their formal role as outlined below). Governance arrangements - oversight of risk registers 2.8 Regular consideration by senior management of Service risks and Service risk registers is expected, but how such consideration is undertaken has previously not been prescribed as it was considered appropriate to ensure that how risks are considered is aligned to and integrated within each Service areas own distinct management arrangements. All Services have been encouraged however to regularly review risk registers for completeness and to ensure that Service risks are reported regularly to Service management teams. 2.9 Recent changes to internal governance arrangements at senior management level within the Council have, however, provided an opportunity to strengthen and further embed risk management and specific responsibilities in respect of risk have been included in relevant terms of reference. The Corporate Management Team (CMT) will retain responsibility for oversight of corporate risks and ensuring that these are being managed in accordance with the approved Risk Management Strategy. Service Management Team (SMT) meetings are now formally expected to regularly review and monitor service risk registers ensuring that registers are complete and up-to-date, and that new and emerging risks are identified, assessed and managed effectively and that service risk registers are used to support management discussions and inform decision-making. 2.10 The corporate risk team will be developing formal measures to review and report on compliance in this aspect of the Council’s risk arrangements during 2023-24. The Corporate Risk team will continue to work with Corporate Risk Leads and Service Risk Champions to ensure that risks registers continue to capture and reflect the current key challenges facing the organisation. Strategic and operational risks of current focus 2.11 Strategically significant risks of current focus include responding to the ongoing challenges presented by current inflationary pressures and increased uncertainty over future levels of funding for local government in light of wider developments in UK and Scottish public sector finances. These issues have been the subject of recent reports to the Policy and Strategy Committee. 2.12 The Council is also fully engaged with wider policy developments which have the potential to impact significantly on the Council and its corporate ambitions. This includes ongoing attempts to understand, assess and respond effectively to the likely significant impacts on service users, staff and the Council more generally of the National Care Service draft legislation and associated guidance. Responding to the outcomes arising from the current consultation by the Scottish Government on the future of education in Scotland is also likely to be of increasing focus. National developments in both areas will continue to be kept under review and actioned as required, with updates provided to relevant Committees at key development points.
Page 4
2.13 The National Care Service (Scotland) Bill proposals allows Scottish Ministers to transfer social care responsibility from local authorities to a new national service. Policy and Strategy Committee were provided with a report in September 2022 which provided an update on the then current position of the Bill. 2.14 In view of the significant and wide-ranging impact which the NCS proposals are likely to have on the Council and the future delivery of support to individuals and families, the Policy and Strategy Committee (in September 2022) approved the establishment of a Member Officer Group to guide the council’s future engagement with the Bill process, support planning and management of the potential impacts for the council, and ensure the delivery of public services remain steadfast during what is expected to be a significant period of change. 2.15 The Bill also has significant implications for the council in terms of the proposed transfer on existing functions and staffing, the wider impact on service delivery and delivery of The Plan for North Lanarkshire, and on the future functions of the council. A separate report from management outlines how the Council plans to ensure the ongoing identification and effective management of associated risks and provide oversight in relation to the operational impact on future council functions. 2.16 Operationally, the Council continues to manage a wide range of risks associated with day-to-day service delivery and progressing projects and programmes of work. Significant operational risks of current focus currently include work underway to ensure the resilience of the Council’s home care service in light of ongoing pressures and the increased challenges facing the Service over the winter period and ongoing work around responding in both the short and longer-term to current and future challenges around the provision of school transport. Staffing issues, including industrial action and responding to recruitment and retention challenges, have also featured prominently in recent months. Finally, risk issues continue to be addressed in relation to a number of significant projects and programmes of work including the Enterprise Contract, which was the subject of a report to Policy and Strategy in December. Review and updating of the Risk Management Strategy 2.17 The planned review of the existing Corporate Risk Management Strategy has now been undertaken, with the proposed revised strategy being reported to the Policy and Strategy Committee for approval in March 2023. Full details of the planned changes will be included in that report, but the Panel should note that the proposed changes to the strategy are, overall, relatively minor and are designed to deliver incremental improvements to what is assessed as an already sound strategic approach. 2.18 It is being proposed as part of the revised Corporate Risk Management Strategy that there will be some focus on ‘fine-tuning' the risk scoring approach to ensure this provides greater differentiation in ratings (and rationale for those ratings), that will enable CMT and elected members to better distinguish areas that require more focus particularly within the ‘High’ residual risk category. More details on the impact of this change (if approved) will be provided in the next update to the Panel. 3. Measures of success 3.1 The corporate risk management team will continue to report quarterly to BMT and CMT and the Audit and Scrutiny Panel providing an overview of key developments in risk management and updating on progress in respect of planned improvements to the Council’s risk management arrangements.
Page 5
3.2 The adequacy and effectiveness of the Council’s risk management arrangements will be independently and regularly reviewed by Internal Audit, who will report directly on the results of that work to the Audit and Scrutiny Panel. 3.3 Effective risk management arrangements assist the Council in achieving planned outcomes and/or help the Council mitigate the impacts of adverse events. 4. Supporting documentation Appendix 1: 2022-23 corporate risk register Appendix 2: Risk scoring matrix and descriptors Ken Adamson Chief Officer - Audit and Risk
Page 6
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective risk management arrangements including the identification, assessment, management and oversight of relevant risks will increase the likelihood of the Council achieving its ambitions and plans by making it more likely that the Council will be able to effectively mitigate potential threats to planned outcomes. It also contributes to effective management of risks relating to all service and operational areas. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒
Page 7
Appendix 1: 2022-23 corporate risk register CORPORATE RISKS (Operational) Likelihood Impact Rating Evaluation 1. Information Governance – Data Migration 5 5 25 High 2. Information Governance & Information Security 5 4 20 High 3. ICT operational capability 4 4 16 High 4. Public Protection 4 4 16 High 5. Human Resources 4 4 16 High 6. Governance Leadership & Decision Making 4 4 16 High 7. Supply Chain Risk 4 4 16 High 8. Scottish Child Abuse Inquiry 4 4 16 High 9. Health and Safety 5 3 15 High 10. Business continuity planning 5 3 15 High 11. Terrorism 3 5 15 High 12. Procurement risk 3 4 12 Medium 13. Resilience planning 2 5 10 Medium 14. Serious organised crime, fraud and corruption 3 3 9 Medium CORPORATE RISKS (Strategic) Likelihood Impact Rating Proximity 15. Tackling Poverty 5 4 20 High 16. Climate Change 4 4 16 High 17. Implementation of Economic Regeneration Development Plan 3 5 15 High 18. Financial Sustainability 3 5 15 High 19. Enterprise Project 3 4 12 Medium 20. Managing strategic change 3 4 12 Medium 21. Digital and IT strategy 4 3 12 Medium 22. Engagement and consultation 3 3 9 Medium 23. Target Operating Model – (Ensuring resources (workforce, digital and assets) and service delivery are fully aligned to support the successful implementation of the Council’s future operating model. To be confirmed To be confirmed To be confirmed To be confirmed 24. Impact of National Care Service To be confirmed To be confirmed To be confirmed To be confirmed 25. Improving Educational Outcomes To be confirmed To be confirmed To be confirmed To be confirmed
Page 8
APPENDIX 2: LIKELIHOOD / IMPACT DESCRIPTORS AND RISK MATRIX Likelihood Descriptors: Score Probability of occurrence Description 5 Over 90% Almost certain to occur within 12 months 4 61-90% Likely to occur within 12 months 3 31-60% Possible that it may occur within 12 months 2 11 - 30% Unlikely to occur within 12 months 1 10% or less Rare that it would occur within 12 months Impact Descriptors: Score Description of impact On Service Objectives Financial On people On time to recover On reputation 5 Catastrophic Unable to function, inability to fulfil obligations Severe financial loss (over 25% of budget) Death Serious – more than 2 years to recover to pre- event position Highly damaging, severe loss of public confidence 4 Major Significant impact on service objectives Major financial loss (between 10% and 25% of budget) Extensive injury, major permanent harm Major – between 1 and 2 years to recover to pre-event position Major adverse publicity, major loss of confidence 3 Moderate Moderate impact on service objectives Significant financial loss (between 2.5% and 10% of budget) Medical treatment required, semi- permanent harm up to one year Considerable – between 6 months to 1 year to recover to pre- event position Some adverse publicity, legal implications 2 Minor Minor impact on service objectives Moderate financial loss (between 1% and 2.5% of budget) First aid treatment, non- permanent harm up to 1 month Some – 2 to 6 months to recover to pre-event position Short-term public embarrassment and no damage to reputation 1 Insignificant Minimal impact, no service disruption Minimal loss (up to 1% of budget) No obvious harm/injury Minimal – up to 2 months to recover No interest to the media, internal only. Risk Matrix: Likelihood 5 - Almost certain 5 10 15 20 25 4 - Likely 4 8 12 16 20 3 - Possible 3 6 9 12 15 2 - Unlikely 2 4 6 8 10 1 - Rare 1 2 3 4 5 1 - Insignificant 2 - Minor 3 - Moderate 4 - Major 5 - Catastrophic Impact Risk Rating Insignificant 1-3 Low 4-6 Medium 8-12 High 15-25
Page 9
No embedded text on this page.