Risk Management Strategy
North Lanarkshire Council · 16 March 2023
Back to Policy and Strategy Committee — 16 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Policy and Strategy Committee Does this report require to be approved? ☒ Yes ☐ No Ref: RM/PS/KA/LA Date 16/03/23 Proposed Risk Management Strategy 2023 - 2026 From Ken Adamson, Chief Officer (Audit and Risk) E-mail adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to present for consideration and approval a revised and updated Risk Management Strategy for 2023-2026. This proposed updated strategy (at Appendix 1) is intended to replace the previous version which was approved at Policy & Strategy Committee in March 2020. The proposed changes to the strategy are, overall, relatively minor and are designed to deliver incremental improvements to what is assessed as an already sound approach which is consistent with current risk management good practice. The revised strategy reflects the Council’s current organisational structures and corporate expectations in respect of risk management. Effective risk management arrangements form an important element of good corporate governance and are designed to ensure that the Council operates systematic and logical processes for managing risks within a comprehensive framework, ensuring that identified risks are managed consistently, effectively, efficiently and coherently across the organisation. The Audit and Scrutiny Panel has regular oversight of the Council’s risk management arrangements and receives regular reports from senior officers on the operation of the Council’s risk management arrangements as well as the management of key corporate risks. Recommendations Committee is invited to: (1) Approve the revised Risk Management Strategy and accompanying guidance (at Appendix 1); and (2) Endorse the role of the Audit and Scrutiny Panel in providing ongoing elected member oversight of the adequacy and effectiveness of the Council’s risk management arrangements. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 The Council has responsibility for the delivery of a wide range of public services and has set out a range of objectives, priorities and ambitions in The Plan for North Lanarkshire and associated Programmes of Work. The Council faces a range of challenges which could impact on the successful delivery of its services and the achievement of its corporate ambitions. Effective risk management arrangements are intended to ensure that the Council is more likely to achieve its goals and planned outcomes. 1.2 A risk can be anything that might impact on what the Council is trying to achieve. Risk management is about having formal arrangements and processes in place to identify what those risks might be, to assess their potential consequences and to decide how best to reduce the likelihood of those risks occurring and/or mitigate their impact if they do occur. 1.3 When implemented and maintained, the effective management of risk enables the Council to: • Increase the likelihood of it achieving its goals and delivering planned outcomes; • Assist the identification of risks, opportunities and threats; • Establish a reliable basis for decision making and planning; • Effectively allocate and use resources for risk treatment; • Improve organisational resilience; and • Improve governance, stakeholder confidence and trust; 2. Report 2.1 The Risk Management Strategy attached at Appendix 1 for approval, updates the previous version which was approved in 2020. The strategy is intended to ensure that the Council is ‘risk aware’ rather than ‘risk averse’ and that the management of risk is embedded in the Council’s policies, procedures, culture and practices. It is also designed to ensure that key decisions are taken with an understanding of risks and their effective control. 2.2 The strategy has been updated to reflect the Council’s improving risk management maturity, building on work carried out since the previous strategy was approved. It outlines the organisation’s approach to the identification, assessment and management of risks. It includes detailed guidance on the roles and responsibilities of different groups of staff and how risks should be categorised and assessed. 2.3 The revised draft, which has been approved by the Corporate Management Team, reflects input from Service Risk Champions represented on the Risk Management Corporate Working Group and has been amended to ensure it is consistent with current good practice in relation to risk management and reflects the Council’s current organisational structures, newly revised management arrangements and updated expectations in respect of risk management. 2.4 Risk registers form a core element of the Council’s risk management processes at both Service and corporate levels and the strategy includes detailed information on how risk registers should be compiled and be subjected to regular review and challenge. The strategy also details expected arrangements in respect of reporting and monitoring of risks. 2.5 Elected member oversight of the Council’s risk management arrangements is undertaken by the Audit and Scrutiny Panel who receive regular updates on risk management developments including regular detailed reports from relevant officers on the management of those risks identified as key corporate risks.
Page 3
Enhancements following the review and refresh of the Risk Management Strategy 2.6 The most significant aspects of the proposed Risk Management Strategy which differ from the previous version which Committee should note, include: • Inclusion of a ‘Risk Management governance structure’ diagram which clearly lays out the key groups involved in risk management activity across the organisation, and the relationships between them; • A new group category within Roles & Responsibilities for ‘Service Risk Forums’ which have been established to allow Risk Champions to better liaise with and co- ordinate risk activities and reporting requirements with Risk Facilitators across each Service. These Service Risk Forums will support Service Management Teams in relation to their risk management responsibilities. • The Roles & Responsibilities section is now supplemented with information outlining ‘The 3 Lines of Defence’ principles for managing risk which will clarify and assist officers in understanding where responsibility for managing risk lies. • The approach to risk scoring and assessment has been refreshed to provide more specific guidance in the measurement of risk and expected responses to differing levels of risk. There has been some focus on ‘fine-tuning' the risk scoring approach to ensure this provides greater differentiation in ratings (and rationale for those ratings) within the ‘High’ residual risk category, which will enable Chief Officers and elected members to better distinguish areas that require more focus. To enable this the following key changes are proposed: o Risk Likelihood descriptors have been expanded to prompt more detailed thinking around how likely a risk is to occur. o Risk Impact descriptors have been revised to improve the relevance of the categories of potential impact for the organisation, and within the differing levels of impact (major to catastrophic) there is added detail that will allow a more considered and targeted assessment of the likely impacts of a risk if it were to occur. Specific changes noted in impact descriptors are detailed below: Previous impact descriptor New impact descriptor Rationale On Corporate or Service objectives On Service Delivery This category has been changed to relate more to service delivery, meeting standards, and potential disruption. Each level has more meaningful and relatable descriptions which will enable specific consideration of potential impact within this category. Financial Financial While the category heading has been retained, the levels of impact have been revised to more accurately reflect the financial context within which the council is operating and will likely continue to operate within for the foreseeable future. For example, previously a ‘catastrophic’ impact under the financial category was described as a loss of over 25% of budget. This was considered to have little meaning in consideration of financial loss, so the new description for a catastrophic financial impact is >£1Million. This is considered to provide more relevant and comparable parameters for measurement of financial risk impacts.
Page 4
Previous Impact descriptor New Impact descriptor Rationale On people On people (including physical and mental wellbeing) The category has been retained but expanded to reflect both physical and mental well-being impacts on people. Similarly, levels of risk have been revised, for example a catastrophic loss in this category was previously noted as ‘death’. The new description is ‘multiple deaths / major permanent incapacity’. This shows revised consideration of the parameters between catastrophic, major and so on. On reputation On reputation This category has been retained but descriptions have been expanded to provide more context around impacts in relation to both National and Local media as well as potential timescales for how long negative media or public attention and reputational harm might reasonably be expected last. On time to recover *Removed* This category was considered to be less meaningful in that it is difficult for those assessing risk to predict how long it might reasonably take to recover from an incident. The category has been removed and the notion of service disruption has been included within the ‘Service Delivery’ category noted above. *NEW Inspection/ Legal/ Compliance A new category has been introduced which is considered important to the council in terms of potential risk impacts. It was felt there was previously a gap that did not allow risk owners/assessors to consider reasonably or consistently impacts in these areas. This will enable and prompt more detailed consideration of potential impacts that relate to legal and regulatory breaches, negative inspection outcomes and associated potential interventions and repercussions. • In line with good practice and developing risk maturity, the opportunity has been taken to include a section on ‘Risk Appetite’. This clarifies and formalises what is already custom and practice. This section confirms that the Council seeks to be risk aware and not risk averse, which means that we will accept a tolerable level of risk that is balanced and proportionate and which provides a stable risk profile. The new section also provides more guidance on expected responses to different levels of risk, indicating where risks can be accepted through to where risk control measures must be implemented to mitigate risks further.
Page 5
• ‘Fine tuning’ the approach to risk assessment and analysis should enable a more accurate and refined risk profile to emerge, aligned to the new risk rating categories noted in the table below. Creating a new rating of ‘Very High’ for risks which score 25, will allow Chief Officers and Elected Members to better prioritise risk information and risk mitigating actions as well as prompt consideration of escalation of very high risks between registers to ensure they are overseen and managed at the appropriate level of the organisation. The proposed rating categories, revised scoring thresholds and review frequencies are noted below: Residual Risk Score Risk Rating Review Frequency 25 Very High Monthly 16 – 20 High 3 monthly 9 - 15 Medium 6 monthly 4 - 8 Low 9 monthly 1 - 3 Insignificant Annually • The opportunity has also been taken to formalise the council’s risk reporting arrangements and these are detailed within a risk reporting matrix. • For the first time, the strategy outlines how the organisation will go about monitoring performance and compliance with the strategy, noting that results of such checks will be included within reporting to Senior Management and Elected Members. • A final key change to note is the proposed separation of more detailed operational information and instruction into a separate ‘Risk Management guidance’ document which will support the Strategy and provide more detail of how to implement the strategy and ensure compliance with the agreed processes and procedures. Supporting guidance, templates 2.7 The proposed revised Risk Management Strategy for 2023-2026 is attached at Appendix 1. This will be complemented with supporting Risk Management guidance. Consultation and engagement 2.8 The proposed revised Strategy, which has been endorsed by the Corporate Management Team, reflects extensive input from Service Risk Champions represented on the Risk Management Corporate Working Group and has been amended to ensure it is consistent with current good practice in relation to risk management and reflects the Council’s current organisational structures, newly revised management arrangements and expectations in respect of risk management. 2.9 The review exercise has also been informed by informal benchmarking and consultation with other local authorities through the professional forum, the Association of Local Authority Risk Managers (ALARM) Scotland, to ensure consistency of approach and to benefit from any learning opportunities as appropriate. 3. Measures of success 3.1 Effective risk management arrangements increase the likelihood of the Council achieving its planned outcomes, priorities and ambitions. Internal Audit provide independent assurance to senior management and the Audit and Scrutiny Panel on the adequacy and effectiveness of the Council’s risk management arrangements.
Page 6
4. Supporting documentation Appendix 1 – Risk Management Strategy 2023-26 Ken Adamson Chief Officer (Audit and Risk)
Page 7
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective risk management arrangements will enable the Council to manage its risks more effectively, increasing the likelihood of the Council achieving its plans and ambitions by minimising or mitigating potential threats to planned outcomes. A robust Risk Management strategy lays out the framework and underpins all risk management activity across the organisation. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex-Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒
Page 8
RISK MANAGEMENT STRATEGY AN ENTERPRISE WIDE APPROACH TO RISK MANAGEMENT
Page 9
Document Control Title Risk Management Strategy Owner Ken Adamson, Chief Officer Contact adamsonk@northlan.gov.uk Governance Group Audit and Risk Author Ken Adamson, Chief Officer Contact adamsonk@northlan.gov.uk Revision History Number Originator Date Review Commenced Revision description / record of change Document approvals Number Governance Group Date approval granted Date approval to be requested (If document still draft) Draft 3 Policy and Strategy Committee Consultation Record (for most recent update) Status of document consulted upon Stakeholders consulted / date Strategic Alignment The risk management strategy outlines the council’s approach to the management of risk as part of robust corporate governance arrangements designed to enable and support the delivery of all council ambitions and priorities. Next review date Review date December 2025
Page 10
3 Risk Management Strategy 2023 Contents page Foreword 04 Introduction 05 Embedding Risk Management 06 Risk Management Application 07 Risk Registers 08 Risk Management Governance, Leadership and Accountabilities 09 The Three Lines of Defence 14 Risk Management Structure 16 Risk Reporting, Review and Challenge 18 Training and Development 21 Risk Management Guidance 27
Page 11
4 Risk Management Strategy 2023 Foreword The Council is ambitious in its vision for North Lanarkshire. Effective risk management forms an important part of the Council’s corporate governance arrangements designed to ensure we can deliver our ambition for North Lanarkshire to be the place to Live, Learn, Work, Invest and Visit. The Council operates in a complex environment and faces multiple challenges in delivering against its priorities. It is important, therefore, that we have robust arrangements in place to understand the risks we face and take steps to manage them effectively. This strategy sets out a clear direction for how we will identify, assess and manage the risks we face in providing high quality public services and delivering The Plan for North Lanarkshire. It requires the organisation to be risk aware, not risk averse, ensuring that key decisions are taken with a sound understanding of any relevant risks and how we intend to control and manage them. It also ensures that risk management is embedded proportionately in our policies, procedures, culture and practices. With this strategy and its associated operational guidance, we believe that effective risk management can play a significant part in helping the Council deliver our ambitions and making North Lanarkshire the place to Live, Learn, Work, Invest and Visit. Des Murray Chief Executive North Lanarkshire Council Councillor Jim Logue Leader North Lanarkshire Council
Page 12
5 Risk Management Strategy 2023 1 Introduction 1.1 The purpose of this Strategy is to set out the Council’s vision for risk management and to provide a framework to ensure that across the organisation, we manage risk in a manner consistent with good practice. The Strategy provides a supporting framework to ensure the key elements of risk management processes are in place, enabling risks to be dealt with and managed at the appropriate level of the organisation. 1.2 This Strategy is designed to provide the information and guidance necessary to assist the organisation in identifying, evaluating, managing, and monitoring risks that might impact on achievement of the Council’s plans, ambitions and objectives and the delivery of quality public services. 1.3 The Strategy has been developed in accordance with the CIPFA/SOLACE local code of corporate governance, “Delivering Good Governance in Local Government” and the Audit Scotland, “Best Value toolkit : Risk Management” which recognises risk management as an integral part of good corporate governance, and in accordance with the International Risk Management Standard ISO31000 (2018) “Risk Management – Guidelines”. 1.4 Risk Management Standard: ISO 31000 describes risk management as ‘the coordinated activities to direct and control an organisation with regard to risk’. It covers the processes involved in identifying, assessing, and prioritising risks, assigning ownership, taking actions to prevent or mitigate them, and monitoring and reviewing progress. 1.5 Risk management needs to be embedded in the way we do business, the way we make decisions, and in our relationships with partners and suppliers. It is particularly important in times of uncertainty and major change. 1.6 For the purposes of this Strategy, it is useful to define “risk”, and to distinguish a risk from an “issue”: • A Risk can be defined as an adverse event or set of events, which should it occur, will have an impact on the achievement of objectives. Risk is measured by the combination of the “likelihood” of the event occurring, and the “impact” on objectives if it does. The impact can be negative or positive. • An Issue can be described as a risk that is occurring now or that we know is certain to occur. Issues are risks which have become ‘live’. An issue may have arisen because a risk has not been identified or has been identified but has not been managed effectively, or circumstances have changed to make a risk become an issue. Key Benefits of Effective Risk Management Enables and evidences robust and defensible, best value decision making, demonstrating openness, accountability and good governance. Decision making is risk aware rather than risk averse, enabling acceptance of certain risks to achieve particular goals. Enables better use and prioritisation of Council resources to achieve corporate priorities and enhance service delivery. Reduces adverse events, and enables effective and more proactive management of those that occur, reducing time spent “fire-fighting”. Enables identification and maximisation of opportunities and encourages innovation. Positively contributes to the Council’s reputation as an employer and service provider. Provides protection to all stakeholders.
Page 13
6 Risk Management Strategy 2023 2 Embedding Risk Management 2.1 Enterprise Risk Management is a holistic approach which recognises the link between risks at different levels and areas of activity of the organisation, together with those risks arising from relationships and contracts with other parties outwith the Council. This Strategy applies to the management of risks across all areas of activity of the Council and incorporates both a “top down” and “bottom- up” approach. 2.2 Embedding risk management within the Council will be achieved through application of the risk management process of identification, assessment and analysis of risks, and by recording and managing these within risk registers. This process will be replicated at all levels of the Council and in our dealings with third parties and partners. • Corporate Risks are those risks which can impact the Council in achieving its Priorities and stated objectives, or are more strategic in nature and require corporate oversight. For example such risks may have the potential to impact many Services, and can impact significantly on the Council in terms of financial costs and reputational damage. The Corporate Risk Register (CRR) will reflect an amalgamated position of Service level risks, and may also include significant Service level risks which have been escalated for attention at a strategic level. • Service/Divisional/Team Risks are those risks which could impact upon a Service, Division or Team in achieving its objectives. Service risks which are deemed to be significant may be escalated to the CRR in accordance with the Risk Management process. Service risk registers will reflect an amalgamated position of Divisional risks, and may also include specific Divisional risks which have been escalated from a Divisional risk register to be managed or monitored at Service level. Team risks may also be escalated to Division or Service level as determined by application of the Risk Management process. • The council’s Project Risk Management approach and methodology is designed to identify and manage those risks and issues which could threaten delivery of the project, or compromise cost, quality or timescales. Key responsibilities with regard to risk are specifically laid down in the Project Management framework.
Page 14
7 Risk Management Strategy 2023 3 Risk Management Application Managing risk does not mean that we seek to eliminate all risks but aims to reduce risk to an appropriate level with which the organisation is comfortable, this being the organisation’s risk appetite. It is therefore about being risk aware rather than risk averse. Management risk must be carried out in a manner consistent with this framework on an ongoing basis across the organisation, but it is especially important to apply risk management: • During periods of significant change; • At the beginning of and during the lifecycle of projects; • When entering into partnership working; • During budget setting exercises; • During service review and/or structure changes; • As part of procurement exercises; • Following political change; • As part of strategic and service planning and decision-making processes. Risk Management and the Strategic Planning Process To manage risk successfully, there must be links between the council’s risk management arrangements and activities with Strategic and Service Planning activities, taking into account ‘The Plan for North Lanarkshire’ and associated Programmes of Work, as well as individual Service Plans. The following outlines how this will be achieved: • At a strategic level, the Corporate Management Team will review the Corporate Risk Register annually with an interim review taking place at the 6-month interval. Reviews will be informed by horizon scanning activity and include a review of the external environment facing the Council, as well as consideration of other similar authorities’ corporate risk registers; • Review of the Corporate Risk Register will also consider any Service risks which may merit escalation to the corporate register and consider the position of risks across services; • At service level, service risk registers should be reviewed quarterly by Service Management Teams for continued relevance to service activities, and be updated following service planning activity; • Service registers should also be reviewed following the review of the Corporate Risk Register to ensure that any key corporate risks that may impact the service are adequately considered and reflected; • New risks can and should be added at any point where they are identified outwith the formal review process; • This approach ensures that the risk management process is both ‘top down’ and ‘bottom up’.
Page 15
8 Risk Management Strategy 2023 4 Risk Registers 4.1 Risk Registers are used to capture and maintain information on all identified risks relating to each area, in a consistent and comprehensive format. The detail contained in a risk register, including results of analysis and evaluation, will enable Teams, Services and ultimately the Corporate Management Team to compare evaluations, and assess and understand the organisation’s exposure to risk. Registers will be used to track and monitor the ongoing management of risks and their relevant controls and actions, and be used to aid informed decision making. 4.2 Standard format risk registers will be recorded and maintained in the Council’s Risk Management Information System. This system will record information on the identification, assessment (including controls and actions) and ongoing monitoring and management of all significant risks to the Council, its Services and Teams. This detail will enable the Council to assess both its inherent and residual risk exposure, and can be used to track and monitor the management of risk. It will provide ease of analysis of risks and production of Risk Management information to aid decision making. The detailed Risk Management guidance which supports this Strategy contains templates and documentation to enable Teams to capture risk information for this purpose. 4.3 Enterprise Risk Management means that registers are maintained at each level of the organisation, with the flexibility to escalate and de-escalate risks between levels depending on the significance of the risk. 4.4 The levels are: Risk Register Levels Corporate Risk Register (CRR) Corporate risks are owned and overseen by the Corporate Management Team, and will be monitored and reviewed by relevant Corporate Working Groups and/or Service Management Teams on behalf of CMT. Progress on the management of these risks will be regularly reported to the Corporate Management Team and the Audit & Scrutiny Panel as required. The Corporate Register will be subject to a full annual review exercise with an interim review at the 6-month interval. Service Risk Registers Service Risk registers will be maintained by each Service and will require to be reviewed at least once every 3 months to ensure that identified risks are being properly managed in accordance with expected timescales, and to minimise any significant risk exposure. Risks rated as ‘Very High’ or ‘High’ should be reviewed in line with expected frequencies and may be escalated if appropriate for consideration as a corporate risk. Service risk registers should be a reflection of Divisional and Team registers, and include relevant partnership and project risks. Detailed project risks and issues will be recorded within project management documentation. Project Risk Registers Project Risks should be captured and managed within project risk registers (within Project Management documentation - not within the Risk Management Information System) in accordance with the Council’s Project Risk Management process which is embedded within the Council’s approved Project Management Framework. The project risk management process should be followed for all projects, as the risks that can hamper project success or cause adverse impacts on the council, can happen in any project irrespective of the size or spend of the project. Risks relating to the successful implementation of key projects of corporate significance will be considered for inclusion within the corporate risk register. Following project implementation however, there may be residual operational risks which require to be included in the service risk register of the relevant service.
Page 16
9 Risk Management Strategy 2023 5 Risk management governance, leadership and accountabilities Everyone in the Council has a role to play in managing risk and should be aware of their responsibilities. The following clearly sets out the roles and responsibilities for all, split by formalised groups and individuals. 5.1 Roles and responsibilities - Groups Policy and Strategy Committee • Approve the Risk Management Strategy and governance framework and ensure that there is an appropriate review cycle for the strategy; • Support management in the use of risk management as an integral part of business practice; • Consider periodic reports from the Audit and Scrutiny Panel on overall performance of the Council’s Risk Management and Governance arrangements. Audit and Scrutiny Panel • Review and provide independent assurance on the adequacy and effectiveness of the Council’s risk management framework; • Monitor the effective development and operation of risk management arrangements in the Council, including monitoring progress in addressing risk related issues reported to the Panel. Corporate Management Team (CMT) Managing the Risk Management Framework: • Provide high level commitment to supporting, promoting and encouraging good risk management practice throughout the organisation, including appropriate training, and developing a culture that seeks to be risk aware; • Ensure that responsibility for risk management is assigned to an appropriate Chief Officer to oversee corporate risk management arrangements on behalf of the Chief Executive; • Ensure that there is adequate risk management resource to support the organisation in delivering effective risk management; • Develop a comprehensive Risk Management Strategy which: • reflects the Council’s priorities, risk appetite and risk exposures, and that guides the organisation in the management of risk; • is aligned with and supports the delivery of The Plan for North Lanarkshire and the associated Programme of Work • ensures that risk management is embedded in Council policies, procedures and practices, including business and service planning, projects and change initiatives at all levels; • Ensures that key strategic decisions are undertaken with an understanding of the risks and associated controls either already in place or planned; • Receive reports that enable monitoring of delivery of the Risk Management Strategy.
Page 17
10 Risk Management Strategy 2023 5.1 Roles and responsibilities - Groups Corporate Management Team (CMT) Managing Risk: • Own and oversee the Corporate Risk Register, which captures significant Key Corporate Risks; • Ensure the identification, analysis, evaluation and ongoing management of Corporate Risks and that identification of these risks takes into consideration the changing internal and external context in which the Council exists; • Receive regular reports on how corporate risks are being managed; • Ensure that an appropriate member of the CMT is identified and assigned responsibility, on behalf of CMT, to act as “Risk Lead” in assessing, reporting and ensuring the ongoing management of each Key Corporate Risk; • On an ongoing basis, monitor and review the Corporate Risk Register, including progress on planned control actions, and consider reports from the Risk Management Corporate Working Group on risk management matters; • Be proactive in identifying potential new and emerging risks to the organisation; • Ensure that lessons are learnt from incidents, inspections, audits and self-assessments, and that these are considered and reflected where appropriate in the Council’s risk registers. Business Management Team (BMT) • To consider risk management outputs going to Committee and/or the Audit and Scrutiny Panel ensuring that adequate assurance exists on the effective operation of the Council’s risk management arrangements. Service and Divisional Management Teams • To regularly review and monitor service risk registers, ensuring that registers are complete and up to date, that new and emerging risks are identified assessed and managed effectively, and that service risk registers are used to support management discussions and inform decision-making. Specifically, this includes: • Ensuring that risk management is integrated into service management arrangements including planning, performance management, project management and change initiatives; • Actively promoting risk awareness, ensuring that existing and emerging risks are understood and managed effectively within Services; • Ensuring that appropriate training is undertaken within each Service area, in accordance with the approved Risk Management Training Matrix; • Ensuring that there is adequate resource to support risk management within each Service; • Proactively identifying potential new and emerging risks to the organisation; • Ensuring that lessons are learnt from incidents, inspections, audits and self-assessments, and that these are considered and reflected where appropriate in risk registers; • Managing risks on a day-to-day basis, using Service and Project risk registers to monitor risks, plan services and support decision making, ensuring appropriate actions are undertaken on a timely basis; • Consider whether any high-level service risks may require escalation to the Corporate Risk Register. Risk Management Corporate Working Group (RMCWG) • Support CMT in the co-ordination of activities and resources across the Council in order to implement the Risk Management Strategy and embed and promote good risk management practice; • Promote the integration of risk management into Service management arrangements including planning, performance management, project management and change initiatives; • On an ongoing basis, identify and review training requirements to ensure good risk management knowledge and awareness across the Council; • Provide a forum for the sharing of good risk management practice, and share information in respect of existing, new and emerging risks; • Provide risk management support and advice across the organisation; • Be the mechanism for movement of risks between Corporate and Service Risk Registers through Service Risk Champions and the Corporate Risk Team.
Page 18
11 Risk Management Strategy 2023 5.1 Roles and responsibilities - Groups Service Risk Forums • Support Service and Divisional Management Teams in the co-ordination of activities and resources across the Service in order to implement the Risk Management Strategy and embed and promote good risk management practice; • Provide regular reports to Service Management Teams on the management of Service risks and more generally on progress in embedding risk management arrangements within Services; • Promote the integration of risk management into Service management arrangements including planning, performance management, project management and change initiatives; • On an ongoing basis, identify and review training requirements to ensure good risk management knowledge and awareness across the Service; • Provide a forum for the sharing of good risk management practice, and share information in respect of existing, new and emerging risks; • Provide risk management support and advice across the Service; • Be the mechanism for movement of risks between Teams/Services and Corporate Risk Register. Corporate Working Groups • On behalf of CMT, and in conjunction with Risk Leads, key Corporate Working Groups/Management Teams may be tasked with the assessment, monitoring and oversight of those risks on the Corporate Risk Register which link to the work of that group; • Review lessons learnt from any relevant incidents and losses, inspections, audits and self-assessments related to those risks, and reflect and consider the Council’s management arrangements in respect of them. 5.2 Roles and responsibilities - Individuals Elected Members Risk management is an important and integral part of the Council’s governance arrangements and is crucial to the achievement of outcomes. A significant aspect of an Elected Member’s role is in making decisions for the Council and the people of North Lanarkshire. The CIPFA/SOLACE Guidance “Delivering Good Governance in Local Government” makes explicit Elected Member’s decision-making role, and the need to ensure that risk information contributes to the decision making process. Elected Members need to be satisfied, when considering recommendations from officers, that risk has been considered and addressed as part of relevant decision-making activities. Members also need to ensure that the Council’s Risk Management Strategy and policies are suitably aligned with and support the delivery of objectives. In discharging these responsibilities Elected Members will: • Require Officers to develop and implement an effective framework for risk management, and to receive reports on the management of significant risks on a regular basis; • Expect Officers to ensure that committee reports describe significant risks associated with proposals, and detail how these risks will be managed; • Ensure that risk management arrangements are evaluated and monitored on a regular basis. Chief Executive Supported by the Chief Officer (Audit & Risk), the Chief Executive will: • Have overall responsibility for the Council’s Risk Management framework; • Champion risk management at senior level, ensuring that effective arrangements and resources are in place to manage risk; • Be accountable for the management of risk within the Chief Executive’s Service; • Nominate and support a Service Risk Champion, who will co-ordinate risk management activities within the Service; • Promote risk management awareness and practice within their area of responsibility; • Ensure that risk management is integrated into Service planning, performance management and project management arrangements, and is a regular item on the agenda of the Chief Executive’s SMT meetings; • Ensure risks are appropriately managed, monitored, reported, reviewed and escalated where necessary, and that appropriate action to manage risks is undertaken on a timely basis by control and/or action owners.
Page 19
12 Risk Management Strategy 2023 5.2 Roles and responsibilities - Individuals Depute Chief Executive • Accountable for the management of risk within the Services which they oversee as part of their role as Depute Chief Executive; • Nominate and support a Service Risk Champion(s), who will co-ordinate risk management activities within their Service(s). • Promote risk management awareness and practice within their area of responsibility; • Ensure that risk management is integrated into Service planning, performance management and project management arrangements, and is a regular item on the agenda of management meetings; • Ensure their risks are appropriately managed, monitored, reported, reviewed and escalated where necessary, and that appropriate action to manage risks is undertaken on a timely basis by control and/or action owners. Chief Officer (Audit & Risk) • Accountable to the Chief Executive/CMT, and has delegated responsibility for overseeing the Risk Management framework and the Council’s Risk Management function; • Provide regular reports to CMT and the Audit & Scrutiny Panel on the management of Key Corporate Risks and more generally on operational performance and progress in embedding the Council’s risk management arrangements. Corporate Risk Team (Corporate Risk Manager and Corporate Risk Officer) • Co-ordination and continuous development of risk management arrangements across the organisation liaising with CMT and Services on their implementation; • Provide support and guidance to the organisation on the management of risk; • Provide a range of risk management training opportunities to maintain role appropriate knowledge and awareness of risk management across the organisation; • Oversee the development, use and maintenance of the Risk Management Information System to support management of the Council’s risk registers; • Support CMT in the ongoing management of the Corporate Risk Register; • Monitor progress of Services in their implementation of the Risk Management Strategy; • Support the Chief Officer (Audit & Risk) in meeting risk reporting requirements; • Provide project risk management support where required for key projects including facilitation of risk workshops etc. Chief Officers • Accountable for the management of risk within their area of responsibility; • Nominate and support a Risk Facilitator who will liaise with Service Risk Champions to co-ordinate risk management activity across their Divisions and Teams; • Ensure that employees are familiar, as appropriate, with the Risk Management Strategy, guidance and controls relevant to their specific duties; • Ensure that training needs are assessed and met in respect of risk management skills. Managers • Promote risk management awareness and practice within their area of responsibility; • Ensure that risk management is integrated into Service planning, performance management and project management arrangements, and is a regular item on the agenda of management meetings; • Ensure their risks are appropriately managed, monitored, reported, reviewed and escalated where necessary, and that appropriate action to manage risks is undertaken on a timely basis by control and/or action owners. Risk Leads/Owners Those who through the risk management process are identified as having ownershi” of risks; • Responsible for leading on the ongoing management and monitoring of a particular risk assigned to them. Control Owners Those who through the risk management process, are identified as having ownership of either current or planned controls; • Responsible for ensuring that controls are managed and maintained, and that any changes to controls are notified to risk owners so that risks may be reviewed accordingly. Action Owners Those who through the risk management process, are identified as having ownership of those actions deemed necessary to either prevent or mitigate risks; • Responsible for ensuring that risk improvement actions assigned to them are progressed to satisfactory completion.
Page 20
13 Risk Management Strategy 2023 5.2 Roles and responsibilities - Individuals Risk Champions Acting as the point of contact for risk management matters within their Service, the Risk Champion will be responsible for providing assurance to the Depute Chief Executive / Chief Executive/Chief Accountable Officer on whether risk management arrangements are in place and operating effectively in accordance with the Risk Management Strategy. This will be achieved by: • Participating in the work of the Risk Management Corporate Working Group; • Promoting risk awareness across their Service, including contributing to identification of relevant training needs and monitoring of the completion of the same; • Directing risk management discussions at Management Team meetings, ensuring that “Risk” remains a regular item on the agenda; • Guiding, liaising with and supporting Risk Facilitators in Divisions/Teams through the Service Risk Forum; • Supporting their Service Management Team in the ongoing development and management of Service Risk Registers; • Escalating risks to the Depute Chief Executive / Chief Executive/Chief Accountable Officer where immediate attention is required; • Providing project risk management support where required for key projects including facilitation of risk workshops etc; • Monitoring service compliance with the requirements of the Risk Management Strategy, process and procedures; • Engaging in appropriate risk management training to maintain skills and knowledge. Risk Facilitators Acting as the point of contact for risk matters within their Division or Team, Risk Facilitators will be responsible for providing assurance to their Chief Officer on whether risk management arrangements are in place and operating effectively in accordance with the Risk Management Strategy. This will be achieved by: • Liaising with Risk Champions to maintain a co-ordinated approach including through the service risk forum; • Promoting risk awareness across their service area, including contributing to identification of relevant training needs and monitoring completion of the same; • Supporting their Management Teams in the ongoing development and management of Divisional/Team Risk Registers; • Directing risk management discussions at meetings, ensuring that “Risk” remains a regular item on the agenda; • Escalating risk issues to the Chief Officer of the Service and Risk Champion where immediate attention is required; • Engaging in appropriate risk management training to maintain skills and knowledge. Project Managers/Project Boards etc Those involved in delivery of projects for the organisation have specific responsibilities for managing risks and issues within the Project Management process, which could threaten delivery of the project, or compromise cost, quality or timescales. Key responsibilities are specifically laid down in the Project Management framework. Internal Audit Provide independent review, and report on adequacy of the Council’s risk management arrangements and the effectiveness of implementation of the Risk Management Strategy at all levels. Risk & Insurance Team • Put in place and maintain appropriate risk financing arrangements to mitigate against unacceptable financial loss from insured risks, in line with the Council’s risk retention appetite. • Handle in-house all liability and property damage claims within parameters agreed with the Council’s insurance/risk partners; • Feedback to Services, and the RMCWG statistics and loss information that will enable Services to target areas for improved risk control and loss prevention; • Assist Services on control of insurable risks and the improvement of operational risk controls. Employees • Maintain awareness of the Council’s Risk Management Strategy and processes through completing appropriate mandatory Risk Management training; • Be aware of and contribute to the effective identification and management of risks relevant to their own role and that of their team.
Page 21
14 Risk Management Strategy 2023 6 The Three Lines of Defence The Council operates on the principles of the ‘Three Lines of Defence’ model, an internationally recognised framework for managing risk, which provides structure and helps demonstrate key roles and responsibilities within that framework and how these link together to deliver robust risk management. The diagram below illustrates how responsibility for managing risk gets proportionately less as we move down the three lines, with the most significant level of ownership and responsibility for managing risks resting within the first line at the top of the triangle, front line services. • 1st Line of Defence lies with front line/ operational management who maintain ownership, responsibility, and accountability for directly identifying, assessing, controlling and mitigating risks. • 2nd Line of Defence includes those areas that provide the tools and framework to allow the first line to fulfil its role. Includes areas like the Corporate Risk Team, Business & Digital, Legal and Democratic, Finance, Health & Safety etc. This line of defence facilitates and monitors the implementation of effective risk management by the first line, including providing key risk controls, guidance, support, training, advice etc. • 3rd Line of Defence provides independent assurance and includes areas that check activities and arrangements at second and first lines to ensure they are fit for purpose and are being complied with. For example, the Internal Audit function provides assurance to Audit & Scrutiny Panel and senior management about how well the first and second lines are identifying and managing risks, and around implementation and effectiveness of risk controls.
Page 22
15 Risk Management Strategy 2023 North Lanarkshire Council’s Three Lines of Defence Services Operational Procedures, Managing Risk, Control Activity, Projects, Self-Evaluation Oversight/Enabling/Control Functions Corporate Risk Team, Business and Digital, Legal and Democratic, Finance, Health & Safety etc (Framework, Guide, Consult, Train, Advise, Support) Assurance Providers Internal Audit (Monitor Compliance, Provide Independent Challenge and Assurance) 3 2 1 3rd Line of Defence 2nd Line of Defence 1st Line of Defence Figure 1 - Three lines of defence
Page 23
16 Risk Management Strategy 2023 7 Risk Management Structure The following diagram shows the structure of risk management activity in North Lanarkshire Council. Primary responsibility for co-ordination of risk management activities lies with the Corporate Risk Team through the Risk Management Corporate Working Group. Service Risk Champions will be responsible for facilitating and supporting the implementation of risk management within their service activities through their Service risk forums, and reporting progress and risk management information to their own Service Management Teams. Corporate Management Team Chief Officer (Audit & Risk) Corporate Risk Team Service risk forums (1/4ly following RMCWG) Service Management Teams Policy and Strategy Committee RMCWG (8 weekly) Service Committees Audit and Scrutiny Panel Risk Champions Operational Management Employees Figure 2 - Risk Management Process
Page 24
17 Risk Management Strategy 2023 Risk Management Methodology 7.1 Effective Risk Management is about developing the right risk culture, processes and structures in our organisation and directing them in a co-ordinated way to manage risk, facilitate continuous improvement and enhance service delivery. 7.2 Risk Management is about being proactive in understanding risks and uncertainties that can impact on achievement of our goals. It is a continually evolving process which helps us to learn and build upon good practice, ensuring that we manage uncertainty in a proactive way, contributing to successful delivery of services and Corporate Priorities. 7.3 Embedding Risk Management throughout the organisation will be achieved by the consistent application of the risk management process shown at figure 2 (page16), across all Services and business activities. This will enable the organisation to manage and monitor risks at the most appropriate level, ensuring that the right oversight is in place, and that we respond to risk in a consistent and proportionate manner. 7.4 Risk management should not be done in isolation, but requires to be considered by Services, Divisions, Teams and Project Teams as a routine part of Corporate, Service, Operational and Project planning. This means that assessing risk becomes an integral part of our working practices as well as a feature of how we approach development of new policies or business change initiatives. A methodology for managing risk across the organisation has been established and will be consistently applied at all levels. The approach has been developed in accordance with the International Risk Management Standard ISO31000:2018 “Risk Management – Guidelines”. Full details of the Risk Management methodology to be followed are contained in the Risk Management guidance that accompany this strategy. Scope, Context, Criteria Com m unication and Consultation Risk Evaluation Risk Analysis Risk Identification Risk Treatment Risk Treatment M onitoring and Review Recording and Reporting Figure 3 - Process
Page 25
18 Risk Management Strategy 2023 8 Risk Reporting, Review and Challenge 6.1 Different levels of the organisation require different information from the Risk Management process. For example, CMT should know about the most significant Key Corporate Risks facing the Council and how these risks are being managed. Service Management Teams require to be aware of the risks which fall into their area of responsibility which may impact on the services provided by them, and on their ability to achieve their objectives. Teams need to be aware of and take appropriate action on the risks that face the Team. 6.2 Risks identified and their control status should be formally reported to the appropriate level of management and stakeholders on a regular and timely basis to ensure that they receive the appropriate level of management attention. 6.3 To allow for the effective monitoring of risks, a “Risk Owner” should be identified for each risk. This person is responsible for ensuring that plans are in place for reviewing and reporting progress on the management of that risk and associated actions. The “Risk Owner” will be a named individual. 6.4 The Corporate Risk Register will be presented to the Audit and Scrutiny Panel on a quarterly basis. Immediately prior to this, CMT will have reviewed and confirmed that it is comfortable that the CRR is an accurate reflection of the overall risk position for the Council. 6.5 Risk Management reports will also be presented to Service Management Teams on a quarterly basis to enable Service Management Teams to monitor and review key service risks, as well as have oversight of service risk management arrangements. 6.6 Oversight of risk registers is an important and essential part of the risk management process, to ensure that registers represent a reasonable reflection of the organisation’s risk exposure. It will identify any anomalies for example where a risk is rated as “low” but should in fact be “high” or vice versa. Having the correct oversight and challenge will mean that we avoid the inefficient use of time and resources in addressing and reporting on what are in fact lower priorities, or not having sufficient review of key risks which have been wrongly rated and therefore do not receive the appropriate level of management attention. 6.6 The frequency of review for each individual risk will be dependent upon the residual risk rating as follows: Residual Risk Score Risk Rating Review Frequency 25 Very High Monthly 16 – 20 High 3 monthly 9 - 15 Medium 6 monthly 4 - 8 Low 9 monthly 1 - 3 Insignificant Annually 6.7 As part of the risk monitoring and review process, management should monitor, and give proper consideration to progress against risk action plans, review the risk ratings applied to each risk and also give consideration to any new risks which have emerged. 6.8 Where a risk is reviewed by the Service and felt to have either corporate relevance or its significance has escalated to be of corporate interest, this should be raised through the Risk Management Corporate Working Group or with the Corporate Management Team for conclusion as a Key Corporate Risk.
Page 26
19 Risk Management Strategy 2023 6.9 The Council’s Internal Audit Team will undertake regular audits of the Council’s risk management arrangements as part of the annual Internal Audit plan. The Council’s external auditors may also periodically review the risk management processes put in place by the Council as part of their review of the Council’s wider corporate governance arrangements.
Page 27
20 Risk Management Strategy 2023 Risk Management Performance and Compliance Risk Management performance will be monitored within services and across the organisation as a whole to provide assurance to chief officers and Elected Members on organisational compliance with the expectations laid down within this Risk Management Strategy. An agreed compliance approach will be used by the corporate risk team and members of the risk network on a 6 monthly basis to ascertain performance in each area. Results will be incorporated in reporting to CMT, SMTs and Audit & Scrutiny Panel. More detail around the compliance approach is included with the guidance which accompanies this Strategy. Risk Appetite North Lanarkshire Council seeks to be risk aware not risk averse, which means that we will accept a tolerable level of risk that provides a balanced organisational risk profile. The expected responses to the varying levels of risk are generally expected to be: • Insignificant risks are acceptable without any further actions to prevent or mitigate the risk. • Low risks are normally acceptable without any further actions to prevent or mitigate the risk other than to actively monitor existing controls to ensure they continue to operate effectively. • Medium risks are tolerable if we are confident about the arrangements/controls we have in place to manage them. Any additional control measures identified as necessary should be cost effective in relation to the risk. • High risks may be tolerable but we do need to have assurance on the adequacy of controls and monitor them carefully. Any additional control measures which could help prevent or mitigate the risk and/or reduce the risk score, must cost effective. • Very High risks are generally not acceptable and should be actively managed to reduce the risk rating. Consideration should be given to any additional control measures which could help prevent or mitigate the risk and reduce the risk score, where such actions would be cost effective. It is recognised that in certain circumstances there will be high or very high risks over which the council has little direct control or influence or where incidents or errors may occur despite robust controls being in place. In such circumstances the risk management process should ensure appropriate governance and oversight of these risks through frequent monitoring and review of the risk and control arrangements, to provide assurance over the management of these high risks. More detail surrounding risk appetite and expected responses is contained within the Risk Management Guidance which accompanies this strategy.
Page 28
21 Risk Management Strategy 2023 9 Training and Development 9.1 To support the development and embedding of sound risk management practice, it is essential that the Council has a workforce that is equipped with the right levels of knowledge and competence to manage risk, and to make decisions with confidence and awareness of risk. The Council seeks to foster a learning culture, where we learn from events and past experiences in terms of what went well, what we could do better, and reflect on whether we have adequately considered risks. 9.2 The Risk Management Corporate Working Group will continuously identify and review risk management training needs across the organisation. The Corporate Risk Team will provide training and learning opportunities for Elected Members and Officers, which are appropriate and proportionate to roles and responsibilities. 9.3 A Risk Management Training matrix is included within the Risk Management guidance which accompanies this strategy. This may range from those who require a general awareness, to Elected Members and Senior Managers with more strategic decision-making responsibilities, and those employees who have a more specific role in the Risk Management process.
Page 29
22 Risk Management Strategy 2023 10 Risk Management Guidance • Risk Management Methodology and processes • Establishing the Context • Risk Assessment: • Risk Identification and description • Risk analysis • Risk evaluation • Risk response • Risk measurement parameters • Likelihood descriptors • Impact descriptors • Risk Scoring Matrix • Risk appetite levels and expected responses • Risk review instructions • Dealing with Risk in Committee reports • Risk Capture template and instructions Risk Management Methodology The process adopted by the Council for managing risk is summarised below. Step 1. Establish the Context The first step in the risk management process is to understand and define the planned objectives, outcomes and targets of the Service, Division, Team or Project. This will include scope, stakeholders, the environment in which we operate, and any internal and external factors. This is important since the context from a corporate or strategic perspective may be very different from an operational perspective. Step 2. Risk Assessment This is the process where we identify key risks and consider the likelihood and impact of these on achievement of objectives, outcomes and targets. Risk assessment comprises the following three key elements: • Risk Identification • Risk Analysis • Risk Evaluation Scope, Context, Criteria Communication and Consultation Risk Evaluation Risk Analysis Risk Identification Risk Treatment Risk Treatment M onitoring and Review Recording and Reporting Figure 4 - Process
Page 30
23 Risk Management Strategy 2023 Risk Identification This is the systematic use of information from the “Establishing the context” stage to identify and describe risks. When identifying risks, there are 6 risk categories that should be considered: Strategic, Financial, Operational, Human Resources, Legislative and Regulatory and Information Technology. Further detail on each risk category, including subcategories is available in the detailed Risk Management Guidance which supports this Strategy. The risk identification process should, where possible, involve relevant subject matter experts who have knowledge or experience of the activity or matter under consideration. Risks should be described in three parts, covering • The risk event i.e. “there is a risk that…………..” • The cause i.e. “due to……..” • The consequence i.e., “which could result in ……” Each risk should be considered in the context of, and aligned to the Council’s corporate priorities, and those activities that contribute to their achievement. To ensure appropriate ownership of risk, each risk should be assigned to a “Risk Owner”. This is the person who, through the risk management process, is identified as being the most appropriate Officer to lead on the management and oversight of a particular risk. Risk Analysis This is the stage which helps us to establish how significant a risk is and enables prioritisation against other risks. To do this we need to apply a degree of measurement or “risk analysis”. This is the process of estimating the ‘likelihood’ of the risk event occurring and multiplying this by the potential ‘impact’ if it did occur. The Council’s Likelihood and Impact Descriptors and Risk Matrix should be used to guide this process. These matrices are designed to ensure that we adopt a consistent approach to the analysis and measurement of risk across the organisation. This combination of likelihood and impact results in a “risk rating”. This is done in two stages: • Inherent risk rating is calculated first and is done as if there were no controls in place to manage the risk. • Existing controls – we then need to consider what controls are already in place to manage the risk. Controls can be policies, procedures, training or other management arrangements designed to manage risk by either reducing the likelihood of the risk occurring, and/or reducing the impact if it does occur. • Residual risk rating is then calculated after consideration of the effectiveness of existing controls. The residual risk rating will then dictate whether further actions are required to reduce the risk further. This analysis of risk produces a risk rating as follows: Risk Ratings Insignificant Low Medium High Very High Risk Evaluation compares the scores of all of the analysed risks in order to make decisions about their significance in relation to our priorities, objectives, and targets. This produces a “Risk Profile” which enables us to prioritise the risks and decide whether further action is required, with higher rated risks being given more focus. Risk Response involves responding to identified and evaluated risks in a way that is proportionate to the level of risk. This means identifying what, if any, additional actions and controls are required to manage the risk further. Risks may be responded to by means of the 4 “T” s: • Terminate – Avoid or eliminate the risk exposure or activity giving rise to the risk, then it no longer presents a risk to manage. • Treat – implement cost effective actions to modify the risk to a more tolerable level. • Transfer – transfer all or part of the risk to a third party i.e. through contract terms, insurance etc. • Tolerate – accept the level of risk presented as is, but monitor to ensure the risk does not worsen.
Page 31
24 Risk Management Strategy 2023 Risk Assessment Likelihood Descriptors Please note that descriptors are intended to be indicative only and may need to be tailored to the individual objective, project or activity under consideration, for example in line with specific professional guidance, national targets or project parameters. These should be agreed with all stakeholders concerned with the risk. Likelihood Descriptors Score Description 5 Almost Certain Event expected to occur (If occurring treat as an issue) Over 90% likelihood of occurrence 4 Likely Event will probably occur 61-90% likelihood of occurrence 3 Possible Event could occur 31-60% likelihood of occurrence 2 Unlikely Event not expected to occur 11-30% likelihood of occurrence 1 Rare Remote chance event could occur in certain circumstances 10% or less likelihood of occurrence
Page 32
25 Risk Management Strategy 2023 Impact Descriptors Description of impact Score On Service Delivery Financial On people (including physical and mental wellbeing) On reputation Inspection / Legal / Compliance 5 Catastrophic Catastrophic failure in service quality and key service standards are not met; long term catastrophic interruption to operations; several major partnerships are affected Severe financial loss >£1million Multiple deaths Major permanent incapacity Prolonged National and Local condemnation National media(> 3 days) Rapid intervention and/or prolonged attention from legislative/regulatory body Serious breach including potential prosecution Severely critical report 4 Major Major impact to service delivery; multiple service standards not met; long term disruption to operations; multiple partnerships affected Major financial loss £500,000 - £1m Death Major injuries or long- term incapacity/ disability (loss of limb), requiring medical treatment and/or counselling. Serious negative national or local criticism National media (<3 days) Local media >3 days Medium-term attention from legislative/ regulatory body Breach which could lead to litigation or prohibitions Enforcement Action / Critical report 3 Moderate Significant failure of service quality; major partnership relationships strained; serious disruption to service standards Significant financial loss £250,000 - £500,000 Significant injury requiring medical treatment and/or counselling. Some adverse public / local media attention Local media only <3 days Short term attention from legislative/ regulatory body Breach which could lead to claims or inquiry Challenging recommendations but can be addressed with appropriate action plan. 2 Minor Minor impact on service quality/minor service standards are not met; short term impact Moderate financial loss £50,000 - £250,000 Minor injury or illness, first- aid treatment needed. No staff absence required. Minor adverse local/ public/media attention and complaints Very minor attention from legislative/ regulatory body Legal action is unlikely or only minor claims Minor recommendations made which can be addressed by low level of management action 1 Insignificant No impact on service quality/limited disruption to operations Minimal loss <£50,000 Adverse event leading to minor injury not requiring first aid. No interest to the media, internal only. Public concern restricted to local complaints No external interest None or little risk of legal action Small number of recommendations which focus on minor quality improvement issues.
Page 33
26 Risk Management Strategy 2023 Risk Assessment Risk Scoring Matrix Risk Likelihood Almost Certain 5 5 10 15 20 25 Likely 4 4 8 12 16 20 Possible 3 3 6 9 12 15 Unlikely 4 2 4 6 8 10 Rare 1 1 2 3 4 5 1 Insignificant 2 Minor 3 Moderate 4 Major 5 Catastrophic Risk Impact Risk Rating Insignificant Low Medium High Very High Risk Rating Expected Response Insignificant 1 - 3 Insignificant risks score from 1-3 on the risk matrix. We can normally accept these. No further actions would normally be expected to prevent or mitigate the risk. Low 4 - 8 Low risks score from 4 – 8 on the risk matrix. We can normally accept these. We wouldn’t normally need or expect to do anything further to prevent or mitigate the risk other than to actively monitor existing controls to ensure they continue to be effective. Medium 9 - 15 Medium risks score from 9 – 15 on the risk matrix. These can be tolerated if we are confident about the arrangements/controls we have in place to manage them. Any additional control measures identified as necessary should be cost effective in relation to the risk. These risks should be reviewed in a frequent basis by line management and progress should be reported regularly to the Service Management Team. 16 - 20 High High risks score from 16 – 20 on the risk matrix. We can tolerate high risks, but we do need to monitor relevant controls carefully. Consideration should be given to any additional control measures which could help prevent or mitigate the risk and reduce the risk score, where such actions would be cost effective. These risks should be reviewed on an ongoing basis by the relevant Service Management Team who may report or escalate to CMT for consideration/inclusion in the corporate risk register. Very High 25 Very High risks score 25 on the risk matrix. These risks should be actively managed to reduce the risk score. Consideration should be given to any additional control measures which could help prevent or mitigate the risk and reduce the risk score, where such actions would be cost effective. These risks should be reviewed on a more regular basis by the relevant Service Management Team who may report or escalate to CMT for consideration/inclusion in the corporate risk register.
Page 34
27 Risk Management Strategy 2023 Risk Management Reports Report title Purpose of report Report prepared by Frequency of report Reported to Policy & Strategy Committee Corporate Management Team Audit & Scrutiny Panel Service Senior Management Teams Service Committees Risk Management - Corporate Progress report Review and monitoring report to provide updates on key corporate risk management developments, summary of corporate risk register and any key changes to that during the period. Corporate Risk Team Quarterly (CMT prior to ASP) Risk Management – Service Progress report Review and monitoring of service risk management implementation and summary of service risk register together with key changes in the period. Service Risk Champion liaising with Service risk forum quarterly Risk Lead report To provide detailed information on a particular corporate risk (per agreed reporting schedule) Corporate Risk Team/ Risk Leads CMT Monthly ASP quarterly Review of the Corporate Risk Register and corporate risk action plan To report on the review and update of the CRR and seek approval for revised risk profile for coming year. (aligning with the Plan for North Lanarkshire and POW reviews) Corporate Risk Team Annual/six monthly Review of the Service Risk Register and Risk Action Plan(following review of CRR) To seek approval for Resource risk registers and risk control plans Service Risk Champion liaising with Service risk forum Annual/ six monthly (following CRR revise) Risk Management year- end compliance report To advise CMT of Corporate/Services’ compliance with the Risk Management Strategy. To seek approval and to provide an update on progress made in delivering actions in the risk management work plan. To provide an update on progress made on delivering risk control actions. In advance of strategy reviews and annual risk control plans Corporate Risk Team Annual Review of the Risk Management Strategy To seek approval for updates made to the Strategy Corporate Risk Team Biennially following each review of the Strategy
Page 35
28 Risk Management Strategy 2023 Monitoring & Review Once risks have been assessed and rated, they should be on a programme of regular review according to residual risk score as follows, unless circumstances change to suggest the risk should be reviewed sooner: Residual Risk Score Risk Rating Review Frequency 25 Very High Monthly 16 – 20 High 3 monthly 9 - 15 Medium 6 monthly 4 - 8 Low 9 monthly 1 - 3 Insignificant Annually
Page 36
29 Risk Management Strategy 2023 Risk Review Instructions Why To ensure that we have thoroughly assessed and understand the risks which have been identified as significant enough to merit inclusion on the Risk Register, and to gain assurance on how well or otherwise each risk is being managed. Regular reviews of each risk will allow management to understand progress with key actions, any change in risk ratings and the reasons why. Reviews will also assist in understanding how the risk could impact the achievement of objectives and provide managers with relevant risk information to aid informed decision making. It is also an opportunity to challenge whether the risk remains valid or whether it may be a candidate for closing. Who Critical to the process is ensuring that there is appropriate variety and breadth of stakeholder/subject matter expert input to develop information for each risk. This ensures that a balanced, robust and well-informed view of the risk and its assessment is obtained, and ensures a common understanding of the risk and associated controls and actions amongst staff. Risk reviews should be undertaken as part of team meetings (either scheduled or specially called for this purpose) or as part of working group meetings. If this is not possible or appropriate, the review may be conducted remotely gathering input from relevant stakeholders/subject matter experts who are best placed to inform the update to the risk information. When Residual Risk Score Risk Rating Review Frequency 25 Very High Monthly 16 – 20 High 3 monthly 9 - 15 Medium 6 monthly 4 - 8 Low 9 monthly 1 - 3 Insignificant Annually Step 1 Review risk context and wording Take the opportunity to consider whether the risk itself is still valid, or whether there has been any change in context of the risk or whether the risk requires to be reframed/reworded to be more relevant. For example has the risk changed as the result of a change in how the service is delivered, or as a result of a change in the external environment in which we operate. Step 2 Review Current Key Management Controls Current risk management controls are those which are designed to mitigate the risk by either reducing the likelihood of occurrence or mitigating the impact of the risk if it does occur. These should be controls that you know are already in place and are working effectively. Whilst difficult to judge with precision, key controls are those which are significant enough to mitigate the risk from its inherent level to its current residual level. By reviewing what is already in place for the risk, you are seeking to confirm: • Whether the detailed controls are still in place and have the same ownership, confirm with the control owner; • If they are still in place, can we regard them as still being effective in reducing likelihood or impact; • If any controls have been removed, this should be detailed and reflected within the risk score and rationale. • Consider whether there are any controls which you know to be in place which are not currently detailed;
Page 37
30 Risk Management Strategy 2023 Risk Review Instructions Step 3 Review Planned Management actions If the residual risk score is too high and deemed unacceptable, it is necessary to agree the appropriate risk response. If it is agreed that the best response is to treat the risk further, then this section is used to record planned management actions. These are the future actions deemed necessary to bring the risk down from its current “Residual” rating. If an action is not likely to contribute to having this effect, then it may not be necessary to include it so that attention can be focussed on the most important controls. Avoid recording an action that is deemed to be “ongoing” since this is most likely just the same as maintenance of an existing control. Actions should have a target date for completion. If the list of actions will not in themselves bring the risk down to an acceptable level, then this should be identified, with a clear statement of what future work will be done to identify actions required. Conversely, if there are no actions which will reduce the risk further, this should be noted with explanation. If it has been decided to tolerate the risk at its current residual rating and take no further action, this must also be documented with accompanying rationale. By reviewing planned management actions you are seeking to confirm: • Which planned actions have been completed; • If yes, whether any of these actions now constitutes a new management control which improves the control framework for the risk; • If yes, the new control should be added to the controls information in Figtree and assigned a control owner; • If there are any new actions required, and whether any existing actions require to have new target dates. • Ensure the action owner is the correct person and that they have a clear understanding of what their action is and timescales. • Actions should always be linked to a parent control. • Consider whether there are any actions that are no longer relevant and should be removed. (Notify corporate risk team for deletion on Figtree) Step 4 Risk Assessment stage In the context of changes made in previous steps, review the overall position to assess whether the current residual risk score remains accurate or requires adjustment, noting that the risk score could move either up or down depending on the impact of the risk review. Ensure “Rationale” is updated to reflect why particular risk scores have been chosen. Take time to make sure everything looks correct: • Is there anything that is not as expected e.g. a residual Risk Rating greater than Inherent Risk Rating • Is review frequency aligned to the risk rating in accordance with strategy as noted above. Step 5 Review the remaining sections of the risk information for completeness, ensuring they are complete, relevant and current, noting any reasons for blank sections. Pay particular attention to any changes in “Risk Context”, relevant to this risk. Bear in mind any potential impact on likelihood and impact scores.
Page 38
31 Risk Management Strategy 2023 Guidance for dealing with risk in Committee reports How is Risk Management incorporated into the Council’s decision-making process? The principles of risk management relating to decision-making are the same as for any other risk management process. The table below outlines the process. 1. Identify any risks associated with the decision and the implementation of the decision. 2. Assess the impact of the risk and the likelihood of it occurring. 3. Prioritise and include commentary on any significant risks/risks with significant potential impacts in the report. 4. Manage – produce a SMART action plan setting out how the Council intends to minimise the impact or reduce the likelihood of each of the significant risks identified. 5. Review risks with key subject matter experts and relevant statutory officers and amend the risk assessment accordingly. 6. Agree risk assessment with decision-maker clarifying any risks in the risk assessment in order to allow the decision to be made. 7. Update any Service or project risk registers following the decision. Committee report templates include a section ‘Risk Impacts’. The section requires the author to record significant risks identified after carrying out a risk assessment. The risk assessment must record the risks related to the proposed recommendations(s) (including the risks of implementation) and the risks of not taking the recommended action. What is the purpose of the risk assessment? The risk assessment: • Demonstrates that all significant risks related to the decision have been considered; • Provides evidence that the decision-maker has been provided with sufficient information about risks in terms of probability and impact; and • Explains how risks will be managed. What will the risk assessment record? The risk assessment should record: • Risks that may arise if the decision is not taken; • Risks that may arise if the decision is taken; and • Action that will be taken to manage each risk documented if the decision is taken. Who needs to be involved in compiling the risk assessment? The report author will take the lead in compiling the risk assessment using a standard template available via the intranet. Involvement will vary significantly depending on the subject matter and the nature of the decision being sought but may include Subject matter experts, the relevant Chief Officer, the Chief Executive, the Council’s S95 officer and the Monitoring Officer. The report author in consultation with the appropriate Chief Officer should review the report and the risk assessment prior to the report being issued.
Page 39
32 Risk Management Strategy 2023 Does every report require a risk assessment? Do all risks in relation to a proposal have to be recorded in a risk assessment? No. The risks assessment process should be proportionate to the decision being made. The report author and others involved should consider the impact of any associated risk(s) when deciding whether a risk assessment is required or not. It is the responsibility of the report author to ensure that the risk assessment is sufficient for its purpose. If the impacts of identified risks are low or negligible then it is reasonable that the risks are not formally recorded. What should I put in the risk management section of the template? Key risks surrounding a decision and how these are or will be managed should always be highlighted in the narrative of the report. The audience should receive assurance that the author has carried out a proportionate risk assessment related to the issue and recommendations, in compliance with the council’s decision-making risk management guidance. In offering this assurance the report author is confirming that: 1. Risk assessment documentation relating to the decision has been completed and reviewed by relevant senior management; 2. all significant risks relating to the decision and how these will be managed are highlighted in the report and 3. risks relating to the decision have, as appropriate, been included in Service or Project risk registers and will be managed and subject to monitoring and review in accordance with the council’s risk management strategy Will the risk assessment be accessible to the public? The risk assessment will not be published with the Committee papers (although the Committee report will confirm that a risk assessment exists to support the decision sought in the report). However, risk assessments will be subject to the normal rules of disclosure under the Freedom of Information Act 2000 and other relevant legislation.
Page 40
33 Risk Management Strategy 2023 Risk assessment template Decision being sought: Committee and date where decision will be made: Risks identified and potential impacts Probability Likelihood Brief description of how risk is managed or how will it be managed in future? Include in Service or Project risk register (Yes/No) 1. 2. 3. 4. 5. 6. Risk management assessment complettion list 1. Does the risk assessment record key risks that may arise if the decision is taken? YES / NO 2. Does the risk assessment record key risks that may arise if the decision is not taken? YES / NO 3. Does the risk assessment record actions that will be taken to manage each risk documented if the decision is taken? YES / NO 4. Has input to the risk assessment been obtained from subject matter experts and all relevant statutory officers? YES / NO 5. Are all significant risks relating to the decision and how these will be managed highlighted in the report? YES / NO 6. Does the report confirm to decision-makers that a proportionate risk assessment related to the issue and recommendations has been undertaken, in compliance with the Council’s decision-making risk management guidance? YES / NO Completed by: (insert name and date) 7. To be completed after any decision: Have risks relating to the decision, as appropriate, been included in Corporate, Service or Project risk registers YES / NO
Page 41
34 Risk Management Strategy 2023 Risk Record Capture Template Mandatory fields are marked with a red circle. See Appendix 1 for explanations Risk Status Primary Risk Category and Sub Category (see appendix2 ) Secondary Risk Category and Sub Category (see appendix 2 ) Secondary Risk Category and Sub Category (see appendix 2) Risk Title Organisation (business unit) Context Risk Due to Impact Proximity Risk Owner Risk Contact First Assessment Date Corporate Priorities Tick as many as appropriate in relation to the risk. Improve economic opportunities and outcomes. Support all children and young people to realise their full potential. Improve the health & wellbeing of our communities.
Page 42
35 Risk Management Strategy 2023 Risk Record Capture Template Enhance participation, capacity and empowerment across our communities. Improve North Lanarkshire’s resource base. Assessment Inherent Likelihood (see appendix 3) Inherent Impact (see appendix 3) Reason for Inherent Risk Likelihood Reason for Inherent Risk Impact Residual Likelihood (see appendix 3) Residual Impact (see appendix 3) Reason for Residual Likelihood Reason for Residual Impact Risk Response Type
Page 43
36 Risk Management Strategy 2023 Current Key Controls Control Status Control Type Control Type Key Control Control Description Implementation Target Date Implementation Date Control Owner Control Status Control Type Control Type Key Control Control Description Implementation Target Date Implementation Date Control Owner
Page 44
37 Risk Management Strategy 2023 Control Status Control Type Control Type Key Control Control Description Implementation Target Date Implementation Date Control Owner Actions: Each Action must be linked to a parent control and the control status selected must not be’ Implemented’ Action Status Action priority Key Action Action Description Action Owner Target completion date Additional Contact
Page 45
38 Risk Management Strategy 2023 Actions: Each Action must be linked to a parent control and the control status selected must not be’ Implemented’ Action Status Action priority Key Action Action Description Action Owner Target completion date Additional Contact Other Areas Impacted: Could this risk impact other areas of the organisation or partners? If so there needs to be clear communication of this risk. Document this here. Date of capture Date entered on Figtree Signed
Page 46
39 Risk Management Strategy 2023 APPENDIX 1 – Risk Capture Instructions Mandatory fields are marked with a red circle Risk Status Choose from Draft / Live / Closed Primary Risk Category and Sub Category (see appendix ) Chose most relevant Primary and Sub Category form drop down Risk Title A short title/description of the risk. Context Some background information on the risk Risk Free text to describe what the risk or adverse event is. Wording should be “There is a risk that……“. A risk is something which “could” happen. If it happens or is definitely going to happen it becomes an “issue”. Due to Free text to describe the potential causes of the risk occurring. Wording should be “due to….” Impact Free text to describe the potential impact (s) if the risk occurs. Should be worded “which will result in……” Proximity The earliest that this risk could occur: Immediate to one week; One week to one month; One month to six months; Six months to 1 year; One year to five years; Greater than 5 years Risk Owner The person who has responsibility for co-ordinating the management of the risk. First Assessment Date The First Assessment Date needs to be in the past. The system will calculate when the next assessment date is due by frequency in Assessment Tab. Risk Contact This is a person nominated by the Risk Owner as first point of contact for any query regarding the risk. This person will also receive notifications on the risk, new risk, assessment due or overdue in addition to Risk Owner Corporate Priorities Tick any that are appropriate/most appropriate in relation to the risk. Should have at least one and may have all if considered relevant Assessment Inherent Likelihood Each risk should be scored in terms of Inherent Likelihood using the matrix below for guidance. Inherent Likelihood score is the evaluation of the likelihood of the risk occurring if there were no controls in place. Enter the score from the drop-down menu. Inherent Impact Each risk should be scored in term of Inherent Impact using the matrix below for guidance. Inherent Impact score is the evaluation of the potential impact if the risk occurs, if there were no controls were in place. Enter the score from the drop-down menu. Reason for Inherent Risk Likelihood Free text to describe the rationale for the Inherent Likelihood score. Where possible include any factual information to support this rationale. Reason for Inherent Risk Impact Free text to describe the rationale for the Inherent Impact score. Where possible include any factual information to support this rationale. Residual Likelihood Residual Likelihood score is the evaluation of the likelihood of the risk occurring, taking into account the control measures you have identified Residual Impact Residual Impact score is the evaluation of the potential impact if the risk occurs, taking into account the control measures you have identified Reason for Residual Likelihood Same rational as per Reason for Inherent Risk Likelihood Reason for Residual Impact Same rational as per Reason for Inherent Risk Impact Risk Response Type Terminate - Stop the activity giving rise to the risk or choose an alternative solution. This response may be chosen where the residual risk is too high, and the preferred option is terminate. Treat - Implement cost effective measures to control a risk to a more acceptable level. Controls will focus on reducing either the likelihood of the risk occurring, and/or the impact of the risk if it does occur. Chose Treat if there are any action plans. Transfer - Transfer all or part of a risk to a third party, usually achieved through contract terms, insurance, or other means. Tolerate - Agree that any further action to treat a risk is not cost effective or proportionate in relation to the current risk and decide to tolerate it as it is. Controls
Page 47
40 Risk Management Strategy 2023 APPENDIX 1 – Risk Capture Instructions Control Status Choose from Planned , In Progress, Implemented or Enhancing. Enhancing is where there is already a control and it will be further improved. Control Type Prevention where reduces likelihood of risk happening or Mitigation which reduces impact should the risk occur. Key Control If considered a most vital control Control Description Something that reduces the likelihood of the risk occurring and/or mitigate the impacts if it does. Implementation Target Date Date that control was implemented. This is not mandatory Control Owner In council terms while control owner can be a working group committee etc. for capture in Figtree it must be an individual. If it is a group etc. make reference to that effect in the control description and enter as control owner person considered most suitable to co-ordinate the control. Where possible control owner should be a NLC member of staff though there are certain time when control owner will be part of a key partnership e.g. NHS. Do not enter an elected member as a control owner. Actions Action Status Choose from Raised, Underway or Complete Action Priority Choose from Low Medium or High Key Action If considered a most vital action Action Description Details of the action which improve the control Action Owner Same rational as for control owner Additional Contact This person will also receive notifications on a new action, action due or overdue in addition to Action Owner Risk Categories Primary Risk Category Sub Risk Category Definition Strategic Managing Strategic Change Inability of the Council to implement change and reform while still delivering its corporate objectives Digital and IT Strategy Technology is inadequate to support future council initiatives Governance Leadership and Decision Making Ineffective leadership in agreeing a shared ambition and strategy for North Lanarkshire. Lack of clarity in defining responsibilities and appropriate governance across the complex roles for all Elected Members and senior staff. Health and Social Care Integration IJB is ineffective with knock on impact on the Council SW or that NLC cannot provide adequate support for IJB priorities Financial Policies and Controls Inadequate financial control over council activities including partnership arrangements Financial Sustainability Lack of funding to manage council activities in current and future years. Capital and revenue grant funded programmes Inability of NLC to deliver on a major capital or revenue programme/project where there is potential for grant clawback.
Page 48
41 Risk Management Strategy 2023 Risk Categories Operational Procurement Risk Failures in the procurement process designed for the purchase and ongoing management of goods, services, and works. Engagement and Consultation with Communities, Partners and Stakeholders That communities, partners and stakeholders are not engaged in the shaping and delivery of services and that NLC does not optimise the benefits from implementation of the Community Empowerment (Scotland) Act 2015 ALEO Risk ALEOs fail to deliver Council services, expectations or requirements Project Risk Risk arising from inadequate project management. Risk Management Risks arising from inadequate Risk Management Serious Organised Crime, Fraud and Corruption Fraud against the council, employees, members, key partners or stakeholders. Relationships with inappropriate bodies, groups of people/ individuals. Corrupt practices across range of NLC Stakeholders. Terrorism NLC fails to plan, prepare and protect its employees, elected members, the public and our communities. NLC fails to provide a co-ordinated approach and contribution to the Counter Terrorism initiatives led by Police Scotland. Communications Non-compliance with Communications Strategy and Policies across the council. Communications are ineffective, do not reach or are not received from relevant parties Human Resources Human Resources Lack of suitable numbers of appropriately skilled staff. Non-compliance with employment legislation and regulation. Legislative and Regulatory Non-compliance existing and new Legislation and Regulation Non-compliance with Legislation, Regulation and government policies. Health and Safety Failure to comply with the Health & Safety at Work etc Act 1974 and associated legislation protecting the health, safety and welfare of our employees and anyone else who can be affected by our activities. Resilience Planning Inadequate response and participation in a Civil Contingency event Business Continuity Planning Service delivery or business operations are interrupted Information Security and Information Governance Information is not managed securely or that information governance is ineffective. External Inspections External Inspections adverse findings including Best Value. Public Protection Non-compliance with legal obligations/failure to provide adequate Public Protection arrangements Climate Change (mitigation, adaptation and sustainability) Failure to develop and implement measures to create and contribute to having a sustainable environment across North Lanarkshire. This includes all activities in addition to those covered by specific climate change legislation. Tackling Poverty Poverty issues impacting on the lives and outcomes for people who live in North Lanarkshire. Information Technology ICT Operational Capability IT solutions do not support the Council Catastrophic Event Pandemic - Covid 19 Risks arising from a significant prolonged catastrophic event that impacts citizens, staff and service delivery, such as a global pandemic.
Page 49
42 Risk Management Strategy 2023 Training Matrix - Risk Management Knowledge requirements and solutions Audience Risk Management Training Solution Introductionto Risk Management (E-learning) Mandatory for all staff Advanced RiskManagement (E-learning) To be developed Enterprise Risk Management (Internal) 1 day Enterprise Risk Management course (Internal) Inclusion of Risk Management content in SVQ 4 Management Development Programme All employees and elected members (at Induction and Biennially CMT Chief Officers Audit & Scrutiny Panel Risk Champions and Facilitators 3rd/4th Tier Managers TBC Supervisors/Team Leaders TBC Project Managers
Page 50
43 Risk Management Strategy 2023 Glossary of Risk Management Terms Glossary of Risk Management Terms Context Context means the external and internal parameters that organisations must consider when they manage risk. External context includes external stakeholders, local, national, and international environment, as well as any external factors that influence objectives. It includes social, cultural, political, legal, regulatory, technological, economic, natural, and competitive environment. Internal context includes internal stakeholders, approach to governance, contractual relationships, capabilities, culture, and standards. Corporate Governance The framework of accountability to users, stakeholders, and the wider community, within which organisations take decisions and lead and control their functions to achieve their objectives Exposure The susceptibility to loss. Impact Effect or consequences of a risk. Examples of a range of impacts can be found in the Impact Matrix. Inherent Risk The exposure arising from a specific risk if no controls were in place to manage it. Likelihood The chance that something might happen. Likelihood can be defined, determined, or measured objectively or subjectively and can be expressed either qualitatively or quantitatively. Mitigating Action Any action that seeks to reduce the likelihood or impact of a risk event to an acceptable level. Monitoring To supervise, check and critically observe on an ongoing basis. Monitoring will help determine the current status and assess whether or not required or expected performance levels are being achieved. Operational Risk Risks associated with the day-to-day issues facing the organisation in its service delivery, i.e., human error, system failures, inadequate procedures, and controls. Probability Extent to which a risk event is likely to occur. A measure (expressed as a percentage) of likelihood. Residual Risk The level of risk remaining taking risk control measures into account. Risk An adverse event or set of events, which should it occur, will have an impact on the achievement of objectives. Risk is measured by the combination of the “likelihood” of the event occurring, and the “impact” on our objectives if it does. Risk Analysis The use of information to work out how often risk events might occur and the magnitude of their consequences. Risk Appetite The Council’s attitude towards risk taking, which in turn dictates the amount of risk it considers tolerable or acceptable. Risk Assessment The overall process of risk identification, risk analysis and risk evaluation. Risk Categories Risks are categorised into different types. The Council’s categories are Strategic, Financial, Operational, Legislative & Regulatory, Human Resources and Information Technology. Risk Control A control is any measure or action that modifies or regulates risk. Controls include any policy, procedure, practice, process, technology, technique, method, or device that modifies or regulates risk. Risk treatments become controls or modify existing controls once they are implemented. Risk Evaluation The process of comparing the net effect of the scores of the analysed risks to make decisions about their significance in relation to our priorities, objectives and targets. Risk Financing The provision of funds to meet the cost of implementing risk treatments, including, but not limited to, insurance. Risk Identification The process by which risk events, which could affect the organisation’s objectives, are identified, described, and recorded. Risk Management The co-ordinated activities to direct and control an organisation with regard to risk. It covers the processes involved in identifying, assessing, and prioritising risks, assigning ownership, taking actions to prevent or mitigate them, and monitoring and reviewing progress. Risk Management Policy Statement A high-level statement showing how Risk Management will be handled throughout the Council.
Page 51
44 Risk Management Strategy 2023 Glossary of Risk Management Terms Risk Management Strategy Describes the goals of applying Risk Management to the activity, a description of the process that will be adopted, the roles and responsibilities, risk thresholds, the timing of Risk Management interventions, the deliverables, the tools, and techniques that will be used and the reporting requirements. It also describes how the process will be co-ordinated with other management activities. Risk Matrix A model that visually displays the relationship between the likelihood and impact of specific risks. Visually it is a 5x5 box that plots likelihood and impact as Insignificant, Low, Medium, or High. Risk Owner A risk owner is a person or entity that has been given the authority to manage a particular risk and is accountable for doing so. Risk Prioritisation The process of ranking risks into a logical order by establishing how significant they are in terms of likelihood and impact (NB Impact is given priority over probability when prioritising risks). Risk Profile The overall picture of the Council’s, Services, or Team’s risks including the number of risks and their scores. Risk Register A formal listing of identified risks, together with the results of the risk analysis and risk evaluation procedures, as well as details of any risk responses. Helps decision makers prioritise resources to minimise risk to best effect and provide assurances that progress is being made. Risk Tolerance Delineation on the risk matrix, risks above which cannot be accepted without referring them to a higher authority. For a project, the project manager would refer these risks to the senior responsible owner (i.e. the person with overall responsibility for ensuring that the project/programme meets its objectives). Risk Response Selection and implementation of appropriate options to further minimise the likelihood or impact of an identified risk. Strategic Risk Risk concerned with where the Council wants to go, how it plans to get there and how it can ensure survival. Terminate Avoid or eliminate the risk exposure or activity giving rise to the risk so that it no longer presents a risk to manage. Tolerate An informed decision to accept the likelihood and the impact of a particular risk rather than trying to mitigate it. This is usually because there are certain benefits to be gained, or the cost and effort of implementing further control measures is disproportionate to the risk. Transfer An informed decision to transfer all or part of the risk to another party who will accept the risk and/or reap the rewards i.e., through contract terms, insurance etc. Treat Implement cost effective actions to modify the risk to a more tolerable level in line with the Council’s risk appetite. Uncertainty A condition where the outcome can only be estimated.
Page 52
This document can be made available in a range of languages and formats, including large print, braille, audio, electronic and accessible formats. To make a request, please contact Corporate Communications at: corporatecommunications@northlan.gov.uk ’S urrainn dhuinn an sgrìobhaidh seo a chur ann an diofar chànanan agus chruthan, a’ gabhail a-steach clò mòr, braille, cruth claisneachd agus cruthan dealanach agus ruigsinneach. Gus iarrtas a dhèanamh, cuir fios gu Conaltradh Corporra aig: corporatecommunications@northlan.gov.uk Niniejszy dokument można otrzymać w wielu różnych językach i formatach, w tym również dużym drukiem, alfabetem Braille’a, w wersji dźwiękowej, elektronicznej i w innych dostępnych formatach. Prośby należy składać na ręce zespołu ds. komunikacji drogą elektroniczną na adres: corporatecommunications@northlan.gov.uk 此文件可以多种不同语言和格式提供，包括大字体、点字、音频、电子和易读格式。 如想提出请求，请联系企业传讯部：corporatecommunications@northlan.gov.uk ۔ ہے سکتا جا ایکیا ہمافر یمیں ںتورصو ئیسار بلقا روا نکار ٹ یلیکٹرا ،وی�ڈآ ، ی�بر ،فوحر ےبڑ لبشمو ںتورصو روا ںنوباز مختلف کو ر�ی�وستاد سا corporatecommunications@northlan.gov.uk : ی ئیں �مافر بطہار پر سا سے ر����ش�ی�کی���و یکمیو ٹ ی�رپورکا یلیے کے ستاخورد مکر ہابر CC_2022_00318 Produced by NORTH LANARKSHIRE COUNCIL Lauren Anthony Risk Manager Chief Exectuties Office Civic Centre, Windmillhill Street Motherwell ML1 1AB t. 01698 403946 e. anthony@northlan.gov.uk NORTHLANARKSHIRE.GOV.UK