Risk Management Update
North Lanarkshire Council · 18 May 2023
Back to Audit and Scrutiny Panel — 18 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref: KA/ASP/2023/May Date 18/05/23 Risk Management update From Ken Adamson, Chief Officer (Audit and Risk) E-mail adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary This report provides the Panel with a brief overview of key risk management developments since the most recent update report to the Panel in February 2023. As well as providing an update on the Council’s corporate risk register and highlighting a selection of the more significant issues which are of current focus from a risk perspective, the report also provides a brief overview of the refreshed Risk Management Strategy which was approved by the Policy and Strategy Committee on 16 March 2023 and of the subsequent actions being taken forward by management. The report also reflects on recent changes in internal governance arrangements and ongoing developments on how risk issues are managed and monitored by senior management and outlines the processes to be undertaken as part of the annual review of the corporate risk register. Strategically significant risks of current focus remain largely unchanged from the last update and include responding to the ongoing challenges presented by current inflationary pressures, delivering approved savings and ensuring the Council is able to effectively respond to expected ongoing pressure on future funding for local government. The Council is also fully engaged with ongoing attempts to assess and respond effectively to the likely significant impacts of the National Care Service draft legislation on service users, staff and the Council more generally. Finally, the approval of a revised Programme of Work to 2028 at the Policy and Strategy Committee in March is being reflected in revised governance arrangements within which effective risk management arrangements will continue to have a key role. Significant operational risks of current focus include work to ensure the resilience of the Council’s home care service in light of ongoing pressures, supporting the operation and resilience of school transport, ongoing work relating to staffing issues, including responding to recruitment and retention challenges and ensuring risk issues continue to be addressed in relation to a number of significant projects and programmes of work. Recommendations The Panel is asked to consider the contents of the report and to: (1) note the current residual scores for those risks agreed for inclusion in the corporate risk register for 2022-23 at Appendix 1; (2) note the references to other topical risk issues highlighted in Section 2; and (3) note the work ongoing to further strengthen and embed risk management arrangements. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 The Council’s Risk Management Strategy requires that the corporate risk register is refreshed on an annual basis, led by the Corporate Risk Team, working with the Risk Management Corporate Working Group (RMCWG) on behalf of, and in consultation with, the Corporate Management Team (CMT). In addition, each Service is required to maintain its own risk register in respect of the operational service risks within their areas of responsibility. CMT previously approved the 2022-23 corporate risk register as outlined in the table at Appendix 1. 1.2 It is widely recognised that the environment within which the Council operates and provides services is dynamic, and corporate and service risk registers must continually evolve to keep pace with, and accurately reflect, the ongoing challenges facing the Council. The Risk Management Strategy sets out required frequencies for the ongoing review by management of both Corporate and Service risks. Revised Risk Management Strategy (approved March 2023) 1.3 The revised Risk Management Strategy recently approved at the Policy and Strategy Committee in March includes a number of changes from the previous version. Overall, these changes are minor and are designed to deliver incremental improvements to what was an already sound approach consistent with current risk management good practice. The revised strategy reflects the Council’s current organisational structures and corporate expectations in respect of risk management. 1.4 The most significant aspects of the revised Risk Management Strategy which differ from the previous version include: • Inclusion of a ‘Risk Management governance structure’ diagram which clearly lays out the key groups involved in risk management activity across the organisation, and the relationships between them; • A new group category within Roles and Responsibilities for ‘Service Risk Forums’ which has been established to allow Service Risk Champions to better liaise with and co-ordinate risk activities and reporting requirements with Risk Facilitators across each Service. These Service Risk Forums will support Service Management Teams in relation to their risk management responsibilities; • The Roles and Responsibilities section is now supplemented with information outlining ‘The 3 Lines of Defence’ principles for managing risk which will clarify and assist officers in understanding where responsibility for managing risk lies; • The approach to risk scoring and assessment has been refreshed to provide more specific guidance in the measurement of risk and expected responses to differing levels of risk. There has been some focus on ‘fine-tuning' the risk scoring approach to ensure this provides greater differentiation in ratings (and rationale for those ratings) within the ‘High’ residual risk category, which will enable Chief Officers and elected members to better distinguish areas that require more focus; • The opportunity has also been taken to formalise the Council’s risk reporting arrangements and these are detailed within a risk reporting matrix; and • For the first time, the strategy outlines how the organisation will go about monitoring performance and compliance with the strategy, noting that results of such checks will be included within future reporting to senior management and Elected Members.
Page 3
2. Report 2.1 The current approved corporate risk register for 2022-23 is at Appendix 1. Risks contained within the register have been subject to ongoing monitoring and review throughout the year, with regular risk reporting to CMT and the Panel both on the overall register, and with detail on individual risks being reported by relevant risk leads. 2.2 The definition of a corporate risk is ‘those risks which can impact the Council in achieving its priorities and stated objectives and/or which are more strategic in nature and require corporate oversight. For example, such risks may have the potential to impact many Services, and/or can impact significantly on the Council in terms of financial costs and/or reputational damage. The corporate risk register will reflect an amalgamated position of Service-level risks and may also include significant service- level risks which have been escalated for attention at a strategic level.’ Update on the 2022-23 corporate risk register 2.3 Since the last update to the Panel, there have been no substantive changes to the risks contained within the corporate risk register or the scores of most of those risks. 2.4 Changes include the ‘Information governance - Data migration’ risk which has reduced from 25 to 15, the ‘Improving educational outcomes’ risk which was previously awaiting scoring but has now been finalised with a residual score of 9 and the ‘Impact of the National Care Service proposals’ which was also previously unscored but which has now been given a residual score of 25, reflecting the significant potential impacts and the difficulty of assessing and mitigating associated risks given ongoing uncertainty about the scope, timing and detailed operational impacts arising from the relevant legislative process. 2.5 Additional issues currently being considered for future inclusion in the corporate risk register include Black Start/power resilience (which is a national risk and relates to how the Council would respond to the highly unlikely event of a total or partial shutdown of the National Electricity Transmission System), home support service delivery and home to school transport. 2.6 Currently all bar one of the risks are classified as ‘live’ with completed risk documentation; the one risk classified as ‘draft’ where relevant documentation is currently being finalised is ‘Target operating model’. 2.7 As reported to the Panel in February, the overall corporate risk profile continues to see a notable number of risks which sit within the ‘High’ category for residual risk rating. This is to be expected because of the complex and challenging environment in which the Council is operating, and the risk profile itself continues to be a key consideration in the planning and decision-making activities of the Council. 2.8 Generally, corporate risks are being reviewed within reasonable timescales, however, there can be occasions where they fall overdue and, when this occurs, Risk Leads are reminded of the need to contact the corporate risk management team promptly when e-mail reminders are received to advise that a risk is due its review. The corporate risk management team then assists in the facilitation and co-ordination of those reviews, and timely consideration allows risk review frequencies to be maintained aligned to risk rating, and avoid risks becoming out of date, ensuring risks are current and reflective of the most current position. Reviewing and updating the 2022-23 corporate risk register 2.9 The corporate risk register is amended as required on an ongoing basis, but is subject to a formal annual review each Spring. The object of undertaking a formal review is that it allows structured consideration of whether the corporate risk register remains up- to-date and properly reflective of the key risks, challenges and issues facing the Council.
Page 4
2.10 The process for reviewing the corporate risk register involves the corporate risk management team reviewing and updating a horizon scanning document which considers the strategic environment facing the Council. The process will also allow consideration of risks associated with the Council’s ambitions and priorities as set out in the revised Programme of Work and consideration as to whether any risks currently sitting within service risk registers should be included in the corporate risk register. Any proposed changes to the corporate risk register will be submitted for approval to the Council’s Business Management Team (BMT) and CMT. The 2023-24 review process will commence shortly and be concluded by the end of May. Governance arrangements - oversight of risk registers 2.11 Recent changes to internal governance arrangements at senior management level within the Council have provided an opportunity to strengthen and further embed risk management and specific responsibilities in respect of risk have been included in relevant terms of reference. CMT retains responsibility for oversight of corporate risks and ensuring that these are being managed in accordance with the approved risk management strategy. Service Management Team (SMT) meetings are now formally expected to regularly review and monitor service risk registers ensuring that registers are complete and up-to-date. They are also expected to ensure that new and emerging risks are identified, assessed, and managed effectively and that service risk registers are used appropriately to support management decision-making. 2.12 The corporate risk management team have now developed formal measures to review and report on compliance with the Council’s risk arrangements during 2023-24. The corporate risk management team will continue to work with corporate risk leads and service risk champions to ensure that risks registers continue to capture and reflect the current key challenges facing the organisation. Snapshot of service risks 2.13 It had previously been proposed to supplement the corporate/strategic risk register information included in this report with a summary of key service risks from service risk registers to enable members to have sight of those risks with the highest residual risk scores. The preparation of this information has, however, led a number of Services to indicate that they require to revisit their risk registers which they considered were not always as complete, accurate and up-to-date as senior management might have wished. 2.14 Rather than present the Panel with incomplete or out-of-date information, risk information drawn from service risk registers will now be reported in August. CMT has recently emphasised to Services that current reviews must be completed as quickly as possible and it is intended to undertake a dry-run at the end of June to assess Service’s ability to provide meaningful information on service risks which can be reported to the Panel in August. Actions are also being taken to ensure that Service Management Teams regularly formally review and monitor risk registers to ensure that registers are complete, accurate and up-to-date, that new and emerging risks are identified, assessed, and managed effectively and that service risk registers are used appropriately to support management discussions and inform decision-making. Strategic and operational risks of current focus 2.15 Strategically significant risks of current focus include responding to the ongoing challenges presented by current inflationary pressures and increased uncertainty over future levels of funding for local government in light of wider developments in UK and Scottish public sector finances. These issues have been the subject of recent reports to the Policy and Strategy Committee.
Page 5
2.16 The Council is also fully engaged with wider policy developments which have the potential to impact significantly on the Council and its corporate ambitions. This includes ongoing attempts to understand, assess and respond effectively to the likely significant impacts on service users, staff, and the Council more generally of the National Care Service draft legislation. Responding to any outcomes arising from the Scottish Government consultation on the future of education in Scotland is also likely to be of increasing focus. National developments in both areas will continue to be kept under review and actioned as required, with updates provided to relevant Committees at key development points. 2.17 Operationally, the Council continues to manage a wide range of risks associated with day-to-day service delivery and progressing projects and programmes of work. Significant operational risks of current focus currently include work underway to ensure the resilience of the Council’s home care service in light of ongoing pressures and the increased challenges facing the Service, and ongoing work around responding to short and longer-term challenges around the provision of school transport. Staffing issues, including recent industrial action, and responding to recruitment and retention challenges, have also featured prominently in recent months. Finally, risk issues continue to be addressed in relation to a number of significant projects and programmes of work including the Enterprise Contract and the planned acquisition of Cumbernauld Town Centre, both of which were the subject of recent reports to the Policy and Strategy Committee. 3. Measures of success 3.1 The corporate risk management team will continue to report quarterly to BMT, CMT and the Panel providing an overview of key developments in risk management and updating on progress in respect of planned improvements to the Council’s risk management arrangements. 3.2 The adequacy and effectiveness of the Council’s risk management arrangements will be independently and regularly reviewed by Internal Audit, who will report directly on the results of that work to the Panel. 3.3 Effective risk management arrangements assist the Council in achieving planned outcomes and/or help the Council mitigate the impacts of adverse events. 4. Supporting documentation Appendix 1: 2022-23 corporate risk register Appendix 2: Risk scoring matrix and descriptors Ken Adamson Chief Officer (Audit and Risk)
Page 6
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective risk management arrangements including the identification, assessment, management and oversight of relevant risks will increase the likelihood of the Council achieving its ambitions and plans by making it more likely that the Council will be able to effectively mitigate potential threats to planned outcomes. It also contributes to effective management of risks relating to all service and operational areas. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒
Page 7
Appendix 1: 2022-23 corporate risk register CORPORATE RISKS (Operational) Likelihood Impact Rating Evaluation 1. Information governance and Information security 5 4 20 High 2. ICT operational capability 4 4 16 High 3. Public protection 4 4 16 High 4. Human resources 4 4 16 High 5. Governance, leadership and decision-making 4 4 16 High 6. Supply chain risk 4 4 16 High 7. Scottish Child Abuse Inquiry 4 4 16 High 8. Information governance – Data migration 3 5 15 Medium 9. Health and Safety 5 3 15 Medium 10. Business continuity planning 5 3 15 Medium 11. Terrorism 3 5 15 Medium 12. Procurement risk 3 4 12 Medium 13. Resilience planning 2 5 10 Medium 14. Serious organised crime, fraud and corruption 3 3 9 Medium CORPORATE RISKS (Strategic) Likelihood Impact Rating Proximity 15. Impact of National Care Service 5 5 25 Very High 16. Tackling poverty 5 4 20 High 17. Climate change 4 4 16 High 18. Implementation of Economic Regeneration Development Plan 3 5 15 Medium 19. Financial sustainability 3 5 15 Medium 20. Enterprise Project 3 4 12 Medium 21. Managing strategic change 3 4 12 Medium 22. Digital and IT strategy 4 3 12 Medium 23. Engagement and consultation 3 3 9 Medium 24. Improving educational outcomes 3 3 9 Medium 25. Target operating model – (Ensuring resources (workforce, digital and assets) and service delivery are fully aligned to support the successful implementation of the Council’s future operating model. To be confirmed To be confirmed To be confirmed To be confirmed
Page 8
APPENDIX 2: LIKELIHOOD / IMPACT DESCRIPTORS AND RISK MATRIX Likelihood Descriptors: Score Probability of occurrence Description 5 Over 90% Almost certain to occur within 12 months 4 61-90% Likely to occur within 12 months 3 31-60% Possible that it may occur within 12 months 2 11 - 30% Unlikely to occur within 12 months 1 10% or less Rare that it would occur within 12 months Impact Descriptors: Score Description of impact On Service Objectives Financial On people On time to recover On reputation 5 Catastrophic Unable to function, inability to fulfil obligations Severe financial loss (over 25% of budget) Death Serious – more than 2 years to recover to pre- event position Highly damaging, severe loss of public confidence 4 Major Significant impact on service objectives Major financial loss (between 10% and 25% of budget) Extensive injury, major permanent harm Major – between 1 and 2 years to recover to pre-event position Major adverse publicity, major loss of confidence 3 Moderate Moderate impact on service objectives Significant financial loss (between 2.5% and 10% of budget) Medical treatment required, semi- permanent harm up to one year Considerable – between 6 months to 1 year to recover to pre- event position Some adverse publicity, legal implications 2 Minor Minor impact on service objectives Moderate financial loss (between 1% and 2.5% of budget) First aid treatment, non- permanent harm up to 1 month Some – 2 to 6 months to recover to pre-event position Short-term public embarrassment and no damage to reputation 1 Insignificant Minimal impact, no service disruption Minimal loss (up to 1% of budget) No obvious harm/injury Minimal – up to 2 months to recover No interest to the media, internal only. Risk Matrix: Likelihood 5 - Almost certain 5 10 15 20 25 4 - Likely 4 8 12 16 20 3 - Possible 3 6 9 12 15 2 - Unlikely 2 4 6 8 10 1 - Rare 1 2 3 4 5 1 - Insignificant 2 - Minor 3 - Moderate 4 - Major 5 - Catastrophic Impact Risk Rating Insignificant 1-3 Low 4-6 Medium 8-12 High 15-25
Page 9
No embedded text on this page.