Strategic Risk Annual Report
Perth and Kinross Council · 29 June 2026
Back to Audit and Risk Committee — 29 June 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Our vision is a Perth and Kinross where everyone can live life well, free from poverty and inequality ___________________________________________________________________ Committee or Board: Audit & Risk Committee Date of Meeting: 29 June 2026 Report Title: Strategic Risk Annual Report Report Number: 26/201 Report Author: L Dott, Team Leader Organisational Lead: L Simpson – Strategic Lead- Legal and Governance ______________________________________________________________ 1. Purpose 1.1 The purpose of this Report is to provide assurance that the Council’s Risk Management Framework is adequate and effective and to advise the Committee of the current key strategic risks facing the organisation and how these risks are being mitigated and managed. 1.2 Sections 1. Purpose 2. Recommendation(s) 3. Background/Context 4. Strategic Risk Review Process 5. Risk Activity 2025/26 6. Next Steps 7. Conclusion 8. Impact Value Assessment 9. Appendices 2. Recommendation(s) It is recommended that the Committee: 2.1 Considers the content of the report and provides appropriate and constructive challenge and comment. 2.2 Notes the current key strategic risks which have been identified through the application of the approved risk management process.
Page 2
2.3 Accepts the assurance as to adequacy and effectiveness of the risk management framework 3. Background/Context 3.1 Sound risk management is central to good governance. It helps the Council make informed decisions, respond to a changing operating environment and maintain focus on delivering sustainable outcomes for the communities of Perth and Kinross. In local government, risks are wide-ranging and often interconnected, shaped by financial pressure, rising demand, legislative change, partnership working and wider economic and social factors. That makes it essential that risk is managed in a systematic, proportionate and continuous way. 3.2 The Council’s Risk Management Framework provides the structure through which risks are identified, assessed, monitored and kept under review. The framework was approved in 2017 and has continued to be reviewed and refined to ensure that it remains relevant, practical and capable of supporting effective decision-making in an increasingly complex environment. Risk management is now embedded as part of the Council’s wider system of internal control, with strategic and operational risks managed through an ongoing cycle of evaluation, prioritisation and mitigation 3.3 The framework is informed by recognised good practice, including ISO 31000, Management of Risk (MoR) and guidance from the Association of Local Authority Risk Managers (ALARM). Together, these provide the basis for a consistent corporate approach to risk across the organisation. The framework comprises: • Risk Management Policy, setting out the Council’s commitment to effective risk management. • Risk Management Strategy, describing the Council’s overall approach and risk hierarchy. • Risk Appetite Statement, explaining the level of risk the Council is prepared to tolerate in pursuit of its objectives. • Risk Management Process Guide, providing practical tools and guidance to support a consistent approach across the organisation. 3.4 Risk is assessed by considering both the likelihood of it materialising and its potential impact, including financial and non-financial consequences. Risk cannot be eliminated entirely, so the Council applies proportionate controls and mitigation measures to manage exposure to an acceptable level. 3.5 The Strategic Risk Register, attached at Appendix 1, sets out the key strategic risks facing the Council at the time of reporting, together with the controls in place to manage them. By its nature, risk is dynamic and subject to change as circumstances evolve. For that reason, risks, scores, controls and mitigating actions are kept under continuous review. While the Register provides a snapshot at a particular point in time, it is operated as a live management document and is routinely reviewed by the Senior Leadership Team.
Page 3
4 Strategic Risk Review Process 4.1 The Strategic Risk Review Process is designed to ensure that the Council’s most significant risks are identified, assessed, prioritised and kept under regular review in a consistent and structured way. It supports a clear corporate understanding of strategic risk, the adequacy of existing controls and where further mitigation may be required. Taken together, the strategic risks provide an overview of the Council’s wider risk landscape and support informed governance and decision-making. 4.2 The Strategic Risk Register opens with a summary of the overall corporate strategic risk position and then sets out each risk in more detail. For each strategic risk, the register records the key causes and consequences, the controls currently in place, an assessment of their effectiveness, and any further actions considered necessary and proportionate to manage exposure. References to risk appetite within the system should be disregarded at this stage, as this remains an area for further development. 4.3 Each strategic risk is expressed in terms of cause and effect. This helps ensure there is a clear understanding of the factors that could lead to the risk materialising and the range of consequences that could arise across the Council. 4.4 Risks are assessed by reference to likelihood and impact. The inherent risk score reflects the level of risk before controls are applied, while the residual risk score reflects the position after existing controls and mitigation are taken into account. In some cases, risks cannot be materially reduced through Council action alone, particularly where outcomes depend on external factors or the actions of partner bodies. Risks are prioritised using the residual risk score as follows: • Priority 1: residual risk score 16–25 • Priority 2: residual risk score 10–15 • Priority 3: residual risk score 6–9 • Priority 4: residual risk score 1–5. 4.6 Based on the current evaluation, the highest priority risks include the protection of vulnerable children and adults, growing the local economy, and addressing poverty and the inequalities gap 4.7 A high residual score does not in itself indicate weak mitigation. In many cases, substantial control and mitigation activity is already in place and is having a positive effect. Risks may remain in the highest priority category because of their scale and complexity, because effective mitigation depends in part on action by other organisations, or because wider external conditions continue to drive uncertainty.
Page 4
4.8 Equally, a lower score does not mean that a risk is of lesser importance. It may instead reflect the relative scope and effectiveness of controls that are already in place and within the Council’s direct influence. Other significant risks may sit within operational risk registers in accordance with the Risk Management Strategy and are monitored and managed by the relevant Strategic Leads and management teams, subject to the escalation and accountability arrangements set out in the wider Risk Management Framework 5. Risk Activity 2025/26 5.1 During 2025/26, the Council continued to strengthen its risk management arrangements, with a particular focus on improving the quality, consistency and visibility of risk information. Risk-trained officers worked closely with Risk Owners and the Strategic Leadership Team to review the strategic risk profile, support changes in risk ownership following service restructure, and provide constructive challenge on risk scoring and assessment. This included focused engagement and follow-up work to test the impact of new and emerging risks within an increasingly complex operating environment. 5.2 Progress also continued in embedding PK Performs as the Council’s core risk management system. A Power BI dashboard for strategic risk has been developed and is being tested with Strategic Leads ahead of wider consultation and roll-out. This is intended to improve the visibility of strategic risk information and strengthen reporting and oversight arrangements. 5.3 During the year, work also began in terms of reviewing corporate risk appetite. The initial exercise was look at strategic risks emerging from operational portfolios and transformation and change activity. A workshop was held with the Strategic Leadership Team in March 2026 and it was agreed that a revised approach should be taken forward, aligned to the development of the new Corporate Plan so that risk appetite and strategic direction are properly connected. The next phase of development will consider political risk appetite and will require engagement with elected members. 5.4 Following the SLT workshop, work commenced with the PK Performs supplier to develop the risk appetite indicator field. The intention is to improve how risk appetite is reflected within the system and to support a clearer and more meaningful relationship between appetite, impact and risk reporting. 5.5 We are working collaboratively as part of the Tayside Risk Management Group to learn and share information and best practice with colleagues and to benchmark to drive improvement. 6 Next Steps 6.1 The next phase of work will focus on further embedding and maturing the Council’s risk management arrangements.
Page 5
This will include responding to the planned internal audit of risk management arrangements and implementing any recommendations arising from that work to strengthen the control environment further. 6.2 The Council will also continue to roll out and embed the Strategic Risk Power BI dashboard as part of its wider approach to improving risk visibility, oversight and reporting. 6.3 Work will continue with the Transformation Programme and Council services to ensure that risk management remains embedded both in project delivery and in business-as-usual activity. At the same time, further improvements will be made to PK Performs to ensure that the system continues to meet organisational needs. 6.4 A revised Risk Appetite Statement will be developed through engagement with Elected Members and officers following development of the new Corporate Plan. This will help ensure that the Council’s approach to risk is aligned with its strategic priorities and decision-making framework. 7. Conclusion 7.1 The Council's Risk Management Framework remains robust and effective. It provides and appropriate basis for identifying, assessing and managing key strategic risks facing the organisation. It will continue to be reviewed throughout 2026/27 to ensure that it remains fit for purpose and responsive to the Council’s changing operating environment. 7.2 A clear programme of work is in place to further strengthen the framework, improve the quality of risk information and support the Council in achieving its strategic objectives. On that basis, assurance can be given that risk is being actively monitored and managed in accordance with the Council’s approved Risk Management framework. 8. Impact and Value Assessment 8.1 This report does not qualify for Impact and Value Assessment. 9. Appendices 9.1 Appendix 1 - Strategic Risk Register