Item 13 - Risk Management Strategy

North Lanarkshire Council · 22 March 2023
Back to Health and Social Care Integration Joint Board — 22 March 2023 and its agenda

Text extracted from the council's PDF. Layout and reading order may differ from the original.

Original council PDF · Download plain text

Page 1

REPORT
Item No: 13
SUBJECT: Risk Management Strategy 
TO: Integration Joint Board Committee
Lead
Officer for
Report:
Ross McGuffie, Chief Officer 
Author(s)
of Report
Ross McGuffie, Chief Officer
Stacey Anderson, Support Services Manager, Project Manager
DATE: 22nd March 2023
1. PURPOSE OF REPORT
This paper is coming to the IJB;
For approval For endorsement To note
2. ROUTE TO THE BOARD
This paper has been:
Prepared  Reviewed Endorsed
By: The Operational Business Manager and Chief Officer for HSCNL and
endorsed by the Risk Managers for North Lanarkshire Council and NHS
Lanarkshire.  
3. RECOMMENDATIONS
3.1 The IJB Committee is asked to:
 Approve the new IJB Risk Management Strategy
4. VARIATIONS TO DIRECTIONS?
5. BACKGROUND/SUMMARY OF KEY ISSUES
5.1  Within the North Lanarkshire Integration Scheme, NHS Lanarkshire and North
Lanarkshire Council committed to deliver an integrated risk management
strategy for the then establishment of the North Lanarkshire Integration Joint
Board. 
5.2 This initial Risk Strategy was put in place for December 2015, and was since
updated and approved at the IJB in January 2018. 
Yes  No  N/A
1

Page 2

5.3 Over the last year, there has been significant development in the IJB’s
approach to risk management, with the risk reports now forming a much more
substantial item of business at IJB meetings. 
5.4 There are three main risk registers across the partnership:
 IJB Register outlining the strategic risks to the Integration Joint Board
 Health operational register, hosted within the NHSL system
 Social Work operational register, hosted within the NLC system
5.5 Strong ties have been maintained with the corporate risk managers in both
partner organisations and the updated strategy has been developed in
conjunction with those leads. The IJB strategy aims to link closely to both the
North Lanarkshire Council and NHS Lanarkshire Risk Management
Strategies. 
5.6 A significant development in the updated strategy is the agreement of a risk
sharing form so that any shared risks from across the system can be notified
to each partner (see appendix 1 of the attached Risk Strategy). This will
ensure a more integrated approach to risk management in North Lanarkshire. 
6. CONCLUSIONS
6.1 Ensuring the management and reporting of risks is undertaken appropriately
is a key responsibility of the IJB.
6.2 The IJB is asked to approve the risk management strategy at appendix 1.
7. IMPLICATIONS
7.1 NATIONAL OUTCOMES
The risk management strategy will assist the identification, recording and
mitigation of risks, thereby supporting the achievement of organisational
outcomes by prioritising and managing risks which may threaten them.
7.2 ASSOCIATED MEASURE(S)
N/A 
7.3 FINANCIAL
This paper has been reviewed by Finance:
Yes   No  N/A
The risk management strategy will support the identification, prioritisation and
management of risks which may threaten financial balance and governance.
7.4 RISK ASSESSMENT/RISK MANAGEMENT
This report sets out the IJB risk register and risk assurance process for the
IJB 
7.5  PEOPLE
2

Page 3

The risk management strategy will support the identification, prioritisation and
management of risks which may threaten the safety of staff and
patients/service users.
7.6  STAKEHOLDER ENGAGEMENT 
Stakeholders are represented at the IJB and the IJB PFA Committee and can
contribute to approval and amendments to the IJB risk register. 
7.6 INEQUALITIES & FAIRER SCOTLAND DUTY 
EQIA Completed & Fairer Scotland Impact Assessment Form Completed:
Yes  No  N/A
The risk management strategy will support the identification, prioritisation and
management of risks which may impact on inequality. 
8. BACKGROUND PAPER
None
9. APPENDICES
Appendix 1: IJB Risk Management Strategy
CHIEF ACCOUNTABLE OFFICER (or Depute)  
Members seeking further information about any aspect of this report, please contact
Ross McGuffie on telephone number 01698 752590.
3

Page 4

Version No. Final 2.0
Date Effective: 31/01/2018 Review Date: 31/01/2020
Appendix 1 
North Lanarkshire Joint Integration Board
Risk Management Strategy 
Executive Lead:   Ross McGuffie, Chief Officer 
Authors:   Carol McGhee, Corporate Risk Manager, NHS Lanarkshire,  
Lauren Anthony, Risk and Insurance Manager, North Lanarkshire Council 
4

Page 5

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
CONTENTS 
Policy – The Risk Management approach ................................................................................................................... 5 
Strategy ‐ Implementing the policy ............................................................................................................................. 7 
1. Introduction ......................................................................................................................................................... 7
2. Risk management process ................................................................................................................................... 8
3. Application of good risk management across the IJB activities ........................................................................... 8
Realising the risk management vision ......................................................................................................................... 9 
4. Risk management vision and measures of success ............................................................................................. 9
Risk leadership and accountability ............................................................................................................................ 10 
5. Governance, roles and responsibilities .............................................................................................................. 10
Resourcing risk management .................................................................................................................................... 11 
6. Resourcing the risk management framework ................................................................................................... 11
7. Resourcing those responsible for managing specific risks ................................................................................. 11
Training, learning and development ......................................................................................................................... 11 
8. Risk management training and development opportunities ............................................................................. 11
Monitoring activity and performance ....................................................................................................................... 12 
9. Monitoring risk management activity ................................................................................................................ 12
10. Monitoring risk management performance ...................................................................................................... 12
Communicating risk management ............................................................................................................................ 12 
11. Communicating, consulting on and reviewing the risk management framework ............................................ 12
5

Page 6

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
Risk Management Glossary 
Key Definitions 
Acceptable Risk  An everyday risk, minor in nature, occurring on a routine basis.  
Adverse Event  Any incident/near miss, event or circumstance arising during service provision that could 
have or did lead to unexpected harm, loss or injury 
Assurance  Stakeholder confidence in our service gained from evidence showing that risk is well 
managed 
Control  Any action, process, policy, practice or operation undertaken to contain a risk to an 
acceptable level, or increase the probability of a positive outcome. 
Exposure  The susceptibility to loss. 
Governance   The framework of accountability to users, stakeholders and the wider 
community, within which organisations take decisions and lead and control 
their functions to achieve their objectives. 
Impact   Effect or consequences of a risk. 
Incident  Occurrence of a particular set of circumstances 
Inherent risk   The exposure arising from a specific risk if no risk controls were in place.   
Initial risk  Based on the likelihood x impact, this is the assessed level of risk if no controls were in 
place 
Likelihood   A qualitative description of a probability or frequency of the risk event 
occurring. 
Mitigating action   Action taken to reduce the likelihood or impact of a risk event to an 
acceptable level. 
Operational risk   Risks associated with the day to day issues facing the organisation in its service delivery. 
Opportunity     An uncertain event with a positive probable impact. 
Probability   Extent to which a risk event is likely to occur. A measure (expressed as a 
percentage) of likelihood. 
Residual risk   The level of risk remaining taking existing or planned risk control measures into account.   
Risk   The chance of something happening that will have an impact on business 
objectives. It is defined as “the probability (likelihood) of an event happening 
and its consequences (impact) when it occurs. 
Risk analysis   The use of information to work out how often specified events might occur and the 
magnitude of their consequences. 
6

Page 7

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
Risk appetite   The organisation’s attitude towards risk taking, which in turn dictates the amount of risk 
it considers tolerable or acceptable. 
Risk assessment   The overall process of risk identification, risk analysis and risk evaluation. 
Risk control  An action undertaken that will reduce risk to an acceptable level either by reducing the 
likelihood of an adverse event, the severity of its consequences or both. 
Risk evaluation   The process of understanding the net effect of the identified threats and 
opportunities on an activity when aggregated together. 
Risk financing  The provision of funds to meet the cost of implementing risk treatments including, but 
not limited to, insurance. 
Risk identification   The process by which risk events, which could affect the organisation’s 
objectives, are identified, described and recorded. 
Risk management   The culture, processes and structures that are directed towards realising potential 
opportunities whilst managing adverse effects. 
Risk management   A high‐level statement showing how risk management will be handled 
Policy    throughout the IJB 
Risk management   Describes the goals of applying risk management to the activity, a description 
Strategy  of the process that will be adopted, the roles and responsibilities, risk 
thresholds, the timing of risk management interventions, the deliverables, the 
tools and techniques that will be used and the reporting requirements.  
Risk matrix   A model that visually displays the relationship between the likelihood and 
impact of specific risks. Visually it is a 5 x 5 box that plots likelihood and 
impact as low, medium, high or very high. 
Risk profile  The overall picture of the organisation’s risks including number of risks and their scores. 
Risk prioritisation   The process of ranking risks into a logical order by establishing how 
significant they are in terms of likelihood and impact (NB Impact is given 
priority over probability when prioritising risks). 
Risk register   A formal listing of identified risks, together with the results of the risk analysis 
and risk evaluation procedures, as well as details of any risk treatments.  Helps Managers 
prioritise resources to minimise risk to best effect and provide assurances that progress is 
being made. 
Risk tolerance line   The delineation on the risk matrix, risks above which cannot be accepted without 
referring them to a higher authority.   
Risk treatment   Selection and implementation of appropriate options for dealing with risk. 
Strategic risk   Risk concerned with where the organisation wants to go, how it plans to get there 
and how it can ensure survival. 
7

Page 8

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
Tolerate/Tolerable  An informed decision to accept the likelihood and impact of a particular 
risk rather than trying to mitigate it usually because there are certain benefits to be 
gained, or further control measures may be disproportionate to the risk. 
8

Page 9

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
Policy Statement – the Risk Management approach
1.1   The North Lanarkshire Integration Joint Board (IJB) aims to provide safe and effective care and treatment 
for patients and clients, and a safe environment for everyone working within the IJB and others who 
interact with the services delivered under the direction of the IJB. 
1.2   Therefore, the IJB is committed to a culture 
where its workforce is encouraged to 
develop new initiatives, improve 
performance and achieve goals safely, 
effectively and efficiently by appropriate 
application of good risk management 
practice. 
1.3   The IJB believes that appropriate 
application of good risk management will 
prevent or mitigate the effects of loss or 
harm and will increase success in the 
delivery of better clinical and financial 
outcomes, objectives, achievement of 
targets and lead to fewer unexpected 
problems. 
1.4   The IJB seeks to promote an environment 
that is risk aware and strives to place risk management information at the heart of key decisions. This 
means that the IJB can take an effective approach to managing risk in a way that both addresses 
significant challenges and enables positive outcomes. 
1.5   The IJB’s Risk Appetite is described as the amount of risk the IJB is prepared to accept, tolerate or be 
exposed to at any one time. Any risk with a current risk matrix score of 10 or above (high or very high 
graded risks) is considered to exceed the IJB’s risk appetite and further actions will be taken to mitigate to 
the lowest possible level. Risks of a score of 9 or less (low or medium graded risks) are considered to be 
within the IJB’s level of risk appetite and will be subject to regular monitoring.  
1.6   In normal circumstances, regular monitoring of risks will be as follows: 
Very High, 
High Risks 
Very High risks (score of 16+) will be reviewed on a monthly basis and High risks (score of 
10‐15) will be reviewed on a 2‐3 monthly basis by the Chief Officer and reported to the IJB 
Sub‐Committee.  
Medium 
Risks 
Medium graded risks (score of 4‐9) will be reviewed on a 5‐6 monthly basis by the Chief 
Officer and reported to the IJB Sub‐Committee. 
Low Risks  Low graded risks (score of 1‐4) will be reviewed annually.  
Key benefits of effective risk management:
 appropriate, defendable, timeous and best value
decisions are made;
 risk aware decisions are based on a balanced
appraisal of risk and allow acceptance of certain
risks in order to achieve a particular goal;
 high achievement of objectives and targets;
 high levels of morale and productivity;
 better use and prioritisation of resources;
 high levels of user experience/ satisfaction with a
consequent reduction in adverse incidents,
claims and/ or litigation; and
 a positive reputation established for the IJB.
9

Page 10

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
1.7  This can be seen clearly in the following matrix: 
1.8   The IJB promotes the pursuit of opportunities that will benefit the delivery of the Strategic Plan. 
Opportunity‐related risk must be carefully evaluated in the context of the anticipated benefits for 
patients, clients and the IJB. 
1.9   The IJB will receive assurance reports on the adequacy and effectiveness of its risk management 
arrangements and will consequently value the contribution that risk management makes to the wider 
governance arrangements of the IJB. 
1.10  The IJB will implement risk management arrangements in line with the Risk Management strategy which 
covers procedures, the risk management process, systems and risk management roles and 
responsibilities. This will contribute to the IJB’s wider governance arrangements.  
Likelihood  Impact 
1 ‐Negligible  2 ‐Minor  3 ‐Moderate  4 ‐Major  5 ‐Extreme 
5 ‐ Almost certain  5 
Medium 
10 
High 
15 
High 
20 
Very high 
25 
Very high 
4 ‐ Likely  4 
Low 
8 
Medium 
12 
High 
16 
Very high 
20 
Very high 
3 ‐ Possible  3 
Low 
6 
Medium 
9 
Medium 
12 
High 
15 
High 
2 ‐ Unlikely  2 
Low 
4 
Low 
6 
Medium 
8 
Medium 
10 
High 
1 ‐ Rare  1 
Low 
2 
Low 
3 
Low 
4 
Medium 
5 
Medium 
10

Page 11

Version No. Final 2.0
Date Effective: 31/01/2018 Review Date: 31/01/2020
Strategy ‐ Implementing the Policy
2. Introduction
2.1   The primary objectives of this strategy will be to: 
 promote awareness of risk and define responsibility for managing risk within the IJB;
 establish communication and sharing of risk information through all areas of the IJB;
 initiate measures to reduce the IJB’s exposure to risk and potential loss; and,
 establish standards and principles for the efficient management of risk, including regular monitoring,
reporting and review.
2.2    The strategy takes a positive approach to risk management. The scope applies to all risks, whether
relating to the clinical and care environment, employee safety and wellbeing, business risk, opportunities
or threats.
2.3   Strategic risks represent the potential for the IJB to achieve (opportunity) or fail to meet (threat) its 
desired outcomes and objectives as set out in the Strategic Plan, and typically these risks require strategic 
leadership in the development of activities and application of controls to manage the risk. 
2.4   Operational risks represent the potential for impact (opportunity or threat) within or arising from the 
activites of an individual service area or team operating within the scope of the IJB’s activities. Parent 
bodies will retain responsibility for managing operational risks as operational risks will be more ‘front‐line’ 
in nature and the development of activities and controls to respond to these risks can be led by local 
managers and team leaders.  Where a number of operational risks impact across multiple service areas or, 
because of interdependencies, require more strategic leadership, then these can be proposed for 
escalation to ‘strategic risk’ status for the IJB. 
2.5   All risks will be analysed consistently with an evaluation of risk as follows: 
Risk Score   Review 
Very High  16+   Monthly 
High  10‐15  Every 3 months 
Medium   4‐9  Every 6 months 
Low  1‐4   Annually 
2.6   The IJB’s Risk Appetite is described as the amount of risk the IJB is prepared to accept, tolerate or be 
exposed to at any one time. Any risk with a current risk matrix score of 10 or above (high or very high 
graded risks) is considered to exceed the IJB’s risk appetite and further actions will be taken to mitigate to 
the lowest possible level. Risks of a score of 9 or less (low or medium graded risks) are considered to be 
within the IJB’s level of risk appetite and will be subject to regular monitoring as detailed above.  
11

Page 12

Version No. Final 2.0
Date Effective: 31/01/2018 Review Date: 31/01/2020
3. Risk management process
3.1   Risk Management is about the culture, processes and 
structures that are directed towards realising potential 
opportunities whilst managing adverse effects1  It is pro‐active 
in understanding risk and uncertainty, it learns and builds 
upon existing good practice and is a continually evolving 
process that has an important role in ensuring that 
defendable and beneficial decisions are made. 
3.2   The IJB embeds risk management practice by consistent 
application of the risk management process shown in the 
diagram on the right, across all areas of service delivery and 
business activities. 
3.3   All reports to the IJB will detail the relevant risks associated or 
emergent.  
4. Application of good risk management across the IJB activities
4.1   Standard procedures (4.1.1 – 4.1.12) will be implemented across all areas of activity that are under the 
direction of the IJB in order to achieve consistent and effective implementation of risk management. 
4.1.1  Full implementation of the risk management process.  This means that risk management information 
should be used wherever possible to guide major decisions in the same way that cost and benefit analysis 
is used. 
4.1.2  Identification of risk using standard methodologies, and involving subject experts who have knowledge 
and experience of the activity or process under consideration. 
4.1.3  Risks should be described in three parts, covering: 
 The root cause (weakness) ie “There is a risk that..........”
 The trigger (initiating event or action) ie “ because of......”
 And the impact (consequence) : “resulting in...............”
4.1.4  Categorisation of risk under the headings below: 
 Strategic Risks: such as risks that may arise from Political, Economical, Social, Technological, Legislative
and Environmental factors that impact on the delivery of the Strategic Plan outcomes.
 Operational Risks: such as risks that may arise from or impact on Clinical Care and Treatment, Social
Care and Treatment, Customer Service, Employee Health, Safety & Well‐being, Business Continuity/
Supply Chain, Information Security and Asset Management.
4.1.5  Appropriate ownership of risk. Specific risks will be owned by/assigned to whoever is best placed to 
manage the risk and oversee the development of any new risk controls required. 
4.1.6  Consistent application of the agreed risk matrix to analyse risk in terms of likelihood of occurrence and 
potential impact, taking into account the effectiveness of risk control measures in place. The risk matrix to 
be used is shown at 1.7 and a list of the impact descriptors for both partner organisations is detailed in 
Appendix 2.  
1 Australia/ New Zealand Risk Management Standard, AS/NZS 4360: 2004
12

Page 13

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
4.1.7  Risks will be scored initially without consideration of controls to provide an inherent  (initial)  risk score. 
Thereafter risks will be scored taking account of controls measures in place to mitigate the risk, giving a 
residual (current) risk score. 
4.1.8  Consistent response to risk that is proportionate to the level of risk. This means that risk may be 
transferred elsewhere (ie to another partner or third party); rejected; accepted as it is; or, mitigated with 
cost effective measures to bring it to a level where it is acceptable or tolerable for the IJB in keeping with 
its appetite/ tolerance for risk.  In the case of opportunities, the IJB may take an informed risk in terms of 
tolerating it if the opportunity is judged to be (1) worthwhile pursuing and (2) the IJB is confident in its 
ability to achieve the benefits and manage/ contain the associated risk. 
4.1.9  The IJB recognises the importance of working in partnership with all relevant internal and external 
stakeholds, most notably North Lanarkshire Council, NHS Lanarkshire, South Lanarkshrie IJB, externally 
commissioned services and third sector partners. A memorandum of understanding is in place with North 
Lanarkshire Council and NHS Lanarkshire to ensure an integrated approach to risk management (see 
appendix 1).  
4.1.10  Implementation and maintenance of risk registers as a means of collating risk information in a consistent 
format allowing comparison of risk evaluations, informed decision‐making in relation to prioritising 
resources and ease of access to information for risk reporting. 
4.1.11  Reporting of strategic risks and key operational risks to the IJB on an ongoing basis.    
4.1.12  Operation of a procedure for movement of risks between strategic and operational risk registers will be 
facilitated by the Chief Officer.   
4.2   Routine reporting of risk information within and across teams and a commitment to a ‘lessons learned’ 
culture that seeks to learn from both good and poor experience, will support the sharing of good practice 
and reductions in adverse events, associated complaints and claims.   
Realising the risk management vision –  
5. Risk management vision and measures of success –
Appropriate and effective risk management practice will be embraced throughout the IJB as an enabler of 
success, whether delivering better outcomes for the people of North Lanarkshire, protecting the health, 
safety and well‐being of everyone who engages with the IJB or for maximising opportunity, delivering 
innovation and best value, and increasing performance. 
5.1   In working towards this risk management vision the IJB aims to demonstrate a level of maturity where risk 
management is embedded and integrated in the decision making and operations of the IJB. 
5.2   The measures of success for this vision will be:  
 Successful delivery of the strategic plan, objectives and targets
 Successful outcomes from external scrutiny
 Improved safety
 Promotion of innovation
 Assurance that information is accurate and that controls and systems are robust and defensible
 Fewer unexpected/ unanticipated problems
 Positive financial outcomes for the IJB
 Fewer incidents/ accidents/ complaints
 Fewer claims/ less litigation
 Consistent reporting and presentation of risks
 Recording the risk management process
13

Page 14

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
Risk leadership and accountability  
6. Governance, roles and responsibilities
There needs to be clarity of ‘who does what’otherwise risk remains unidentified, causing loss that could 
otherwise be controlled or avoided. The strategy defines individual and organisational arrangements across 
the IJB and Health and Social Care Partnership.  
6.1   Joint Integration Board  
6.1.1  Members of the IJB are responsible for: 
 oversight of the IJB’s risk management arrangements;
 receipt and review of reports on strategic risks and any key operational risks that require to be brought to
the IJB’s attention; and,
 ensuring they are aware of any risks linked to IJB reports concerning new priorities, policies or emerging
from performance updates. Risks associated with such proposals should be recorded in the ‘other
implications’ section of the relevant IJB report.
6.2   Chief Officer
6.2.1  The Chief Officer has overall accountability for the IJB’s risk management framework, ensuring that 
suitable and effective arrangements are in place to manage the risks relating to the functions within the
scope of the IJB. The Chief Officer will keep the Chief Executives of the IJB’s partner bodies informed of
any significant existing or emerging risks that could seriously impact the IJB’s ability to deliver the
outcomes of the Strategic Plan or the reputation of the IJB.
6.3   Chief Finance Officer 
6.3.1  The Chief Finance Officer will be responsible for promoting arrangements to identify and manage key 
business risks, risk mitigation and risk financing.  
6.4   Senior Leadership Team (SLT) 
6.4.1  Members of the Senior Leadership Team are responsible (either collectively, or by nominating a specific 
member of the team) for: 
 supporting the Chief Officer and Chief Finance Officer in fulfilling their risk management responsibilities;
 arranging professional risk management support, guidance and training from partner bodies;
 receipt and review of regular risk reports on strategic, shared and key operational risks and escalating any
matters of concern to the IJB; and,
 ensuring that the standard procedures set out in section three of this strategy are actively promoted
across their teams and within their areas of responsibility.
6.5   Individual Risk Owners
6.5.1  It is the responsibility of each risk owner to ensure that: 
 risks assigned to them are analysed in keeping with the agreed risk matrix;
 data on which risk evaluations are based are robust and reliable so far as possible;
 risks are defined clearly to make explicit the scope of the challenge, opportunity or hazard and the
consequences that may arise;
 risk is reviewed not only in terms of likelihood and impact of occurrence, but takes account of any
changes in context that may affect the risk;
 controls that are in place to manage the risk are proportionate to the context and level of risk.
14

Page 15

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
6.6   All persons working under the direction of the IJB 
6.6.1  Risk management should be integrated into daily activities with everyone involved in identifying current 
and potential risks where they work.  Individuals have a responsibility to make every effort to be aware of 
situations which place them or others at risk, report identified hazards and implement safe working 
practices developed within their service areas. This approach requires everyone to: 
 understand the risks that relate to their roles and activities;
 understand how their actions relate to their own, their patient’s, their services user’s/ client’s and public
safety;
 understand their accountability for particular risks and how they can manage them;
 understand the importance of flagging up incidents and/ or near misses to allow lessons to be learned
and contribute to ongoing improvement of risk management arrangements; and,
 understand that good risk management is a key part of the IJB’s culture.
6.7   Partner Bodies
6.7.1  It is the responsibility of relevant specialists from the partner bodies, (such as internal audit, external 
audit, clinical and non clinical risk managers and health and safety advisers) to attend meetings as
necessary to consider the implications of risks and provide relevant advice. It is the responsibility of the
partner bodies to ensure they routinely seek to identify any residual risks and liabilities they retain in
relation to the activities under the direction of the IJB.
6.8   Senior Information Risk Owner
6.8.1  Responsibility for this specific role will remain with the individual partner bodies. 
Resourcing risk management 
7. Resourcing the risk management framework
7.1   The parties will make relevant resources avilable to support the IJB in it’s risk management arrangements. 
7.2   Much of the work on developing and leading the ongoing implementation of the risk management 
strategy for the IJB will be resourced through the Senior Leadership Team’s arrangements (referred to in 
6.4). 
8. Resourcing those responsible for managing specific risks
8.1   Where risks impact on a specific partner body and new risk control measures require to be developed and 
funded, it is expected that the costs will be borne by that partner organisation.  
8.2   Financial decisions in respect of the IJB’s risk management arrangements will rest with the Chief Finance 
Officer. 
Training, learning and development 
9. Risk management training and development opportunities
9.1   To implement this strategy effectively, it is essential for people to have the competence and capacity to 
managing risk and make risk judgements with confidence, to focus on learning from events and past 
15

Page 16

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
experience in relation to what has worked well or could have been managed better, and to focus on 
identifying malfunctioning ‘systems’ rather than people. 
9.2   Training is essential in embedding a positive risk management culture across all activities under the 
direction of the IJB and in developing risk management maturity.  The Senior Leadership Team will 
regularly review risk management training and development needs and source the relevant training and 
development opportunities required (referred to in 6.4). 
Monitoring activity and performance 
10. Monitoring risk management activity
10.1    The IJB operates in a dynamic and challenging environment.   A suitable system is required to ensure risks 
are monitored for change in context and scoring so that appropriate response is made. 
10.2    Monitoring will include review of the IJB’s risk profile at Senior Leadership Team level. 
10.3    The IJB risk register will be reviewed regularly at the Senior Leadership Team and at the IJB Sub‐
Committee and IJB five times per year.  
10.4    It is expected that partner bodies and the IJB will share risk reports and information for the purpose of 
highlighting and managing those risks that may have a common impact; and giving assurance within the 
guiding principles of “no surprises”. Risk sharing arrangements are set out in 4.1.9.  
11. Monitoring risk management performance
11.1    Measuring, managing and monitoring risk management performance is essential to the effective delivery 
of key objectives.  
11.2    Appropriate monitoring arrangements will be put in place to provide assurance on the effectiveness of 
mitigating control measures. For example, specific clinical incident data can provide assurance that risks 
associated with the delivery of clinical care are controlled, or, budget monitoring performance indicators 
can provide assurance that key financial risks are under control. 
11.3    The performance data linked to the Strategic Commissioning Plan will also inform the identification of 
new risks or highlight where existing risks require more attention. 
Communicating risk management 
12. Communicating, consulting on and reviewing the risk management framework
12.1  Good communication of risk management information across the IJB is essential to developing a 
consistent and effective approach. 
12.2  This strategy will be widely circulated via the Senior Leadership Team and will form the basis of any risk 
management training arranged by the IJB. 
12.3  This strategy will be reviewed regularly to ensure that it reflects current standards, best practice in risk 
management and fully reflects the IJB’s business environment. 
16

Page 17

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
12.4  Reviewing the IJB’s risk management arrangements on a regular basis will constitute a “Plan‐Do‐Study‐
Act” review cycle that will shape future risk management priorities and activities, inform subsequent 
revisions of this strategy, and drive continuous improvement in the management of risk. 
17

Page 18

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
Integrated Risk Management: Risk Registers
Memorandum of Agreement (MoA)
In continuing to strengthen the risk management partnership arrangements, it will be
necessary to agree how some emerging risks may have impact on more than 1 partner. 
This MoA sets out the process for discussions that will enable risks to be directed to the
relevant risk register(s) for effective ownership and mitigation.
Emerging Risk identified by:  Select Division
Date of identification of emerging Risk: Enter Date
Describe nature of emerging Risk Set out mitigation required
Agree ownership of the nature of the risk and mitigating controls, noting that they may be different for each partner with an
interdependency on the hosting arrangements, delivery and commissioning aspect of the risk and leads for mitigating controls
Initial Assessed Level of Risk = 
Likelihood Scoring x Initial Impact Scoring Who else may this affect?
Select Division
L
I
K
E
L
I
H
O
O
D
IMPACT
1 2 3 4 5
5 5  
☐
10 
☐
15 
☐
20 
☐
25 
☐
4 4   ☐  8
☐
12 
☐
16 
☐
20 
☐
3 3   ☐ 6   
☐
9   
☐
12 
☐
15 
☐
2 2   ☐  4   
☐
6
☐
8   
☐
10 
☐
1 1   ☐  2   
☐
3    
☐
4    
☐ 5    ☐
Select Division
Select Division
Appendix 1 
18

Page 19

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
Does this Risk affect / impact on:
Strategic Commissioning
Intentions ☐
Strategic Planning Intentions ☐
Service Delivery ☐
Performance Targets ☐
Staff, Financial or Clinical
Governance Implications ☐
CMT for consideration with agreement on the risk and impact for one or more
partners 
Agreed Outcome - risk to be added to the following risk registers.  Description,
assessment and mitigation of the risk may vary according to the nature of the impact and
the responsibility for mitigation.
Yes No
NHSL Corporate Risk Register ☐ ☐
NHSL Acute Divisional Risk Register ☐ ☐
North IJB Risk Register ☐ ☐
North H&SCP Risk Register (health and / or social care component
part) ☐ ☐
South IJB Risk Register ☐ ☐
South H&SCP Risk Register (health and / or social care
component part) ☐ ☐
North Lanarkshire Council ☐ ☐
Date discussed and agreed at CMT:   Enter Date
19

Page 20

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
Appendix 2 - Risk Assessment Impact Descriptors 
North Lanarkshire Council
20

Page 21

Document Title: Risk Management Policy and Strategy Owner: Chief Officer
Version No. Final 2.0 Superseded Version: N/A
Date Effective: 31/03/2023 Review Date: 31/03/2025
NHS Lanarkshire
Risk Types and Sub Types with Impact Guidelines 
21