6 Risk Matters, combined risk policy and strategy
Renfrewshire Council · 18 May 2026
Back to Audit, Risk and Scrutiny Board — 18 May 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Page 1 of 3 PUBLIC __________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 18 May 2026 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: “Risk Matters” (combined risk policy and strategy) ___________________________________________________________________ 1. Summary 1.1 1.2 This paper presents the next iteration (version 16.0) of our combined risk policy and strategy, “Risk Matters” to the Board for approval. In this latest revision of Risk Matters, we set out our current arrangements as well as those we aspire to. Fundamentally, good risk management is about helping our organisation make sound decisions, achieve ambitions and encounter fewer shocks along the way. As in previous iterations of Risk Matters, our vision is still that good risk management practice will be embedded in our organisation’s DNA and embraced as an enabler of success, whether in pursuing opportunity and innovation, or managing imminent, shorter-term or longer-term challenges. ___________________________________________________________________ 2. Recommendations 2.1 It is recommended that the Board considers and approves Risk Matters, v16.0. (see Appendix 1) ___________________________________________________________________ 3. Background 3.1 3.2 The council has had a risk policy and strategy for circa 20 years, and every iteration seeks to demonstrate improvement and innovation in risk management at the council. In 2024/25, Willis Towers Watson (WTW) conducted an independent review of the council’s risk management arrangements, and the resulting report was largely very positive. Nevertheless, WTW made some recommendations for us to consider and take forward if we wished to mature further in our approach to, and arrangements for managing risk.
Page 2
Page 2 of 3 PUBLIC 3.3 3.4 3.5 3.6 The revised version of Risk Matters now incorporates many of the WTW recommendations. It should be noted that the council has a Strategic Risk Management Development Plan which underpins Risk Matters and so if the Board approves the revised version at the May Board meeting, a new version of the Strategic Risk Management Development Plan will be created to support the work required to achieve continuous improvement aligned to Risk Matters. Largely remaining unchanged Our overall framework for risk management remains largely unchanged, in that, we continue with the same governance arrangements as before: • Responsibility for managing risk is delegated to each service department. • In contrast, responsibility for the council’s risk management framework comes under the leadership of the Director of Finance and Resources • The Audit, Risk and Scrutiny Board remains the Board responsible for approving Risk Matters, and for considering the 6 monthly reports on strategic, corporate, service and business as usual risks, as well as an annual report on the council’s risk management arrangements. • Key to promoting risk management throughout the service departments is the role of the service risk representatives. • Our core risk management objectives remain unchanged. • Our risk management training offering remains core to ensuring colleagues are equipped with the skills to handle risk well. • Our innovative Business-As-Usual Risk Assurance Model, (BaURAM © Renfrewshire Council) remains key to understanding how well BAU risk is being implemented operationally, and provides assurance linked to the annual governance arrangements. What’s new Material changes in approach in this iteration of Risk Matters, include: • The risk and insurance function has moved from Internal Audit Services and into Business Services, Risk and Safety. • We are maturing our understanding of the differences between risk appetite and risk tolerance, and using this to support effective decision making. • We are making it easier for all/ any colleagues to come forward with information about new risks emerging. • Very High risks will always be owned by a Director. • High risks will always be owned by a Head of Service. Format Finally, Elected Members will note that Risk Matters is unusual in its presentation and styling. This is deliberate, and it is anticipated that using more graphics and images will make this document more engaging for colleagues to read and understand. In its ‘landscape’ format it also naturally lends itself to being an immediately accessible training tool in its own right.
Page 3
Page 3 of 3 PUBLIC ___________________________________________________________________ Implications of the report 1. Financial – not relevant to report recommendations 2. HR & Organisational Development – not relevant to report recommendations 3. Community/Council Planning – not relevant to report recommendations 4. Legal – not relevant to report recommendations 5. Property/Assets – not relevant to report recommendations 6. Information Technology – not relevant to report recommendations 7. Equality & Human Rights – not relevant to report recommendations 8. Health & Safety – not relevant to report recommendations 9. Procurement – not relevant to report recommendations 10. Risk – as per the subject matter of this report 11. Privacy Impact – not relevant to report recommendations 12. Climate Risk – not relevant to report recommendations 13. Children’s Rights – This report does not present a substantive change to an existing policy, function or strategy which will have an impact on children’s rights. The report itself is therefore largely neural on children. However, our risk management arrangements (outlined in Risk Matters, extend to the management of certain risks which support a number of the Articles contained within the United Nations Convention on the Rights of the Child (Incorporation) (Scotland) Act 2024. For example, our Business-as-Usual Risk Assurance Model covers ‘Community and Public Safety’ risk, supporting Articles: • 19 – protection from violence • 34 – protection from sexual abuse • 35 – protection from sale and trafficking • 36 – protection from exploitation 14. Cosla Policy Position – not relevant to report recommendations ___________________________________________________________________ List of Background Papers (a) Non applicable – as each version of Risk Matters is approved, it supersedes previous versions. ___________________________________________________________________ Author: Karen Locke Strategic Risk & Insurance Services Manager riskmanagement@renfrewshire.gov.uk
Page 4
Appendix 1 Risk Matters v16.0 Effective from 01/04/2026 To review 01/11/2027 Lead Reviewer – Strategic Risk & Ins. Services Mgr. PUBLIC Risk Matters (combined risk policy and strategy) Risk Matters is a key element of our overall risk management framework. PART 1 – RISK POLICY 1. Purpose This policy establishes a proactive, integrated, and adaptive approach to identifying, assessing, mitigating, and monitoring risks that may impact the strategic objectives, service delivery, compliance obligations, and public trust of our organisation. It aligns with ISO:31000 principles and good governance as described by the Accounts Commission. 2. Scope Who - this policy applies to all our services, elected members and colleagues. Nature - it covers strategic, corporate, service, project and business-as-usual risks. Categories - it applies to causal factors/ sources of risk; and, Timeline - it applies to risk in the here and now, medium term and longer term. 3. Risk Management Principles The following principles guide our implementation of effective risk management across all council activities. • Accountable: we will ensure clear ownership for risk identification, control and monitoring, involving relevant stakeholders in the analysis and communication of risk. • Compliant: we will ensure we deliver on our statutory duties and the regulations that apply to us as a local government organisation in Scotland. Risk nature Strategic – outward focused, linked to delivery of council and community plans. Corporate – inward focused, affecting multiple service departments or requires notable corporate resourcing for cause or potential impacts Service – affects a single service and should be managed within allocated budgets Project – linked to the successful delivery of a project in terms of delivery of outputs and realisation of planned outcomes, on time and within allocated resources. Business-as-usual risks – linked to every-day activities with a focus on risk assurance for internal control. Risk categories Employees and Service Users; Finance and Economy; Social and Community; Digital and Cyber; Environmental and Natural; Geopolitical and Supply Chain Resilience; Public Health and Biological; Programmes and Projects; Information and Communications. Risk Management Framework
Page 5
Appendix 1 Risk Matters v16.0 Effective from 01/04/2026 To review 01/11/2027 Lead Reviewer – Strategic Risk & Ins. Services Mgr. PUBLIC • Integrated: we will embed risk management into decision-making, strategic planning and performance monitoring, service design, operational delivery, and project management, making use of the best available historical data, stakeholder input, forecasts, and subject matter expert judgment and supporting excellent governance. • Learning: we will continuously seek improvement through learning and adaptation, recognising that human factors and our organisational culture significantly influence effective risk management. • Proactive: we will anticipate and prepare for risks before they materialise and we will make the most of opportunities as they arise, while managing related risks effectively. • Proportionate: we will promote a consistent approach that enables reliability and comparability across the council, in a way that is right for us as an innovative local government organisation in Scotland, operating in an environment of ongoing financial challenge. • Resilient: we will build capacity and agility to absorb shocks and adapt to change, including emerging risks. • Transparent: we will promote open communication and reporting of risks across all types of risk. 4. Risk Governance We will ensure that the governance arrangements for risk management activity in our organisation are clear and unambiguous. This means that everyone will know their responsibilities for identifying, recording, managing, monitoring, reporting and embedding good risk management and information sharing across all aspects of the council’s business (sometimes referred to as enterprise risk management). 5. Risk Appetite & Tolerance The terms appetite and tolerance are often used interchangeably but they are quite different. Risk Appetite Risk Tolerance Strategic choice Operational limit Broad, high-level Specific, detailed Forward-looking Reactive or adaptive Willingness to take risk Capacity to absorb risk Sets direction Sets boundaries Our risk appetite is formally considered and reviewed every five years, aligned to our strategic objectives (Council Plan 2022- 2027), our values and long-term goals. For each of our strategic objectives, we determine if we have an Averse, Minimal, Cautious, Open, or Eager appetite for risk [ ref HM Treasury Risk Appetite Guidance ] Driving Analogy Appetite – I’m aiming to drive at avg. 60mph for my road trip as this will get me to my destination as quickly as possible, while driving efficiently. Tolerance – there are times when I will need to stay within 50mph due to potential hazards and conditions. Finance Analogy Appetite – I want to invest £50k with a specific bank because of the forecast return on investment. Tolerance – For security reasons I will cap my investment with a single bank at £20k.
Page 6
Appendix 1 Risk Matters v16.0 Effective from 01/04/2026 To review 01/11/2027 Lead Reviewer – Strategic Risk & Ins. Services Mgr. PUBLIC Our tolerance levels for risk are clearly defined in relation to our risk categories, the likelihood of risk arising and impact/s should they arise. We use a risk matrix to ensure all risk is evaluated consistently. Risk will be evaluated as low, moderate, high or very high. Low risk will usually be acceptable and very high risk unacceptable. Moderate and high risks can usually be tolerated but we need to be confident in our ability to manage and contain them, and in the case of high risk, ensure more robust monitoring. We also need to be aware of compound risk – where risks on their own may be tolerable but viewed together are more serious. From time to time (largely due to external pressure) we can and will absorb some very high risk, requiring increased monitoring. Very high risks will always be owned by a Service Director. High Risks will always be owned by a Head of Service. 6. Risk Management Process A key feature of risk is uncertainty, therefore good risk management seeks to better understand risk involving all relevant stakeholders, so we can manage it appropriately and in a proportionate way. This applies to all risk, whether potential adverse outcomes or positive risk in relation to maximising opportunities. We adopt an industry recognised process which helps us understand and manage risk effectively. 7. Technology & Innovation The Council will leverage digital tools for risk tracking, risk assurance, data analytics, and real-time reporting. Cybersecurity measures, continued AI adoption, and business continuity systems will be regularly reviewed and tested. 8. Training & Culture All employees and elected members will have access to appropriate training for risk management, linked to their responsibilities for managing risk and in keeping with our risk management training strategy. A culture of openness, learning, and continuous improvement will be promoted across the organisation, and everyone will be encouraged to report in any perceived risks relating to their services, working environments and activities. 9. Review & Continuous Improvement This policy will be reviewed every two years or in response to significant changes in the risk landscape, legislation, or organisational structure. Lessons learned from incidents and audits will inform updates. This policy is endorsed by Alastair MacArthur, Director of Finance and Resources, on behalf of the Corporate Management Team, for full implementation across all council services. 10. Compliance & Monitoring Monitoring ongoing compliance with Risk Matters will be the responsibility of the Strategic Risk & Insurance Services Manager, supported by the Corporate Risk Officer. Performance will be reported annually to the Audit, Risk & Scrutiny Board. From time to time, Internal Audit Services may also include a review of corporate and service-level compliance within the Annual Audit Plan. Dated 1 April 2026.
Page 7
Appendix 1 Risk Matters v16.0 Effective from 01/04/2026 To review 01/11/2027 Lead Reviewer – Strategic Risk & Ins. Services Mgr. 1 PUBLIC PART 2 – RISK STRATEGY 1. Executive Summary We promote a culture where our employees are encouraged to develop new initiatives, improve performance and achieve goals safely, effectively and efficiently by appropriate application of good risk management practice. In doing so we aim to protect vulnerable people, deliver high quality services for all service users, achieve high standards of performance, make the most of opportunity, and provide a safe environment for those we employ, contract or partner with in providing a wide range of services. 2. Vision Good risk management practice will be embedded in our organisation’s DNA and embraced as an enabler of success, whether in pursuing opportunity and innovation, or managing imminent, shorter-term or longer-term challenges. We will use risk information to make fair judgments and good decisions. We will learn from the past to build a better and more resilient future. We will work with our partners for the benefit of our citizens. 3. Strategic Risk Management Objectives In working to our objectives shown below, we can deliver benefits to the council with measures of success including better financial outcomes, delivery of business objectives and targets, better project success rates, good outcomes from external scrutiny, fewer unexpected problems, fewer incidents, accidents or complaints, and fewer insurance claims/ less litigation. Enablers Leadership and management Our members, directors and senior officers will fully support and promote risk management Policy and strategy Our policy and strategy will be fit for purpose, ensuring a consistent approach to managing risk and increasing effectiveness People Our people will be equipped and supported to manage risk well Partnerships and Resources Our arrangements for managing risk in partnerships will be effective and risk activity will be appropriately resourced Processes Our processes will be effective in supporting effective risk management across all aspects of council business/ services Results Risk handling and assurance Risks will be handled well, and we will have assurance that risk controls are embedded in business-as-usual activity Outcomes and delivery Good risk management will make a difference, contribute to achieving positive outcomes for the council and support innovation We are fair We are helpful We are great collaborators We value learning
Page 8
Appendix 1 Risk Matters v16.0 Effective from 01/04/2026 To review 01/11/2027 Lead Reviewer – Strategic Risk & Ins. Services Mgr. 2 PUBLIC 4. Current State Analysis • Governance – our risk management roles and responsibilities are clear. Our reporting arrangements are well embedded. Groups • Audit, Risk & Scrutiny Board (ARSB) – approves the risk policy and strategy and provides oversight and scrutiny of the whole risk management framework, implementation and practice, receiving regular risk reports (6 monthly), and an annual report on the efficacy of the council’s risk management arrangements. • Chief Executive and Corporate Management Team (CMT) – ensures implementation of enterprise risk management across the corporate body and using data effectively to support risk-based strategic decisions. The CMT ensures that key risks to the organisation’s objectives are being identified and reported to the ARSB, and that the organisation is clear about its appetite for risk in relation to its key objectives. CMT is also responsible for strategic horizon scanning. The Director of Finance & Resources is the CMT’s chief officer who leads on the council’s risk management arrangements, supported by the Head of Business Services, Risk and Safety. • Corporate Risk Management Group (CRMG) – consists of service risk reps and risk specialist/ subject matter experts. The CRMG monitors the Strategic Risk Management Development Plan and key risk management performance indicators. The group leads risk management initiatives across all services, ensures ongoing awareness raising of risks that are of mutual interest, undertakes risk deep dives and shares good practice. • Risk Management Alliance (RMA) – consists of subject matter experts who report into the CRMG. The RMA is a centre of risk expertise, supporting colleagues across the organisation. Core disciplines include risk management, insurance and claims handling, health and safety, internal audit and civil contingencies. From time to time the group is supplemented by other internal stakeholders as required. Through the RMA, services can also access other sources of expertise such Police, Insurers and/ or Insurance brokers/ advisors. The RMA work together and support each other in risk-related matters of mutual interest. Individuals • Elected members – will ensure that when making key decisions for the council and the people of Renfrewshire that they are aware of the potential risks and benefits of such decisions. Board reports will highlight risk information and how this relates to the council’s risk appetite. • Directors – will ensure arrangements are in place in their service departments for routinely identifying, managing and reporting risks and that risk management activities are adequately resourced. Directors will ensure that any proposals to Boards are in line with the council’s risk appetite and that members are made aware of any material risks that may be impacted by or arise from their decisions. • Heads of Service – responsible for promoting and ensuring risk management principles are embedded across their teams’ activities and for providing assurance in respect of business-as-usual risks. • Service Managers – promote risk awareness across all teams, encouraging early identification and reporting of risk, communicating and consulting with subject matter experts in the assessment of risk and supporting their teams to manage the risks effectively. • Service risk reps – promote good risk management in their service departments, representing their services on the CRMG. The reps promote corporate initiatives, ensure regular risk reporting and local improvement re corporate risk KPIs. • Strategic Risk & Insurance Services Manager – ensures the council’s risk management framework and supporting arrangements are fit for purpose, providing professional advice and training in relation to its implementation, and developing officers to be able to handle risk well. This role reports to the Head of Business Services, Risk & Safety, and is responsible for reporting of risk information to the Audit, Risk & Scrutiny Board. • Corporate Risk Officer – monitors performance and corporate compliance with all aspects of the council’s risk management framework and supporting arrangements. This role is a corporate partner for service risk management representatives.
Page 9
Appendix 1 Risk Matters v16.0 Effective from 01/04/2026 To review 01/11/2027 Lead Reviewer – Strategic Risk & Ins. Services Mgr. 3 PUBLIC • Our objectives – our objectives are well defined and supported by our Strategic Risk Management Development Plan and by appropriate key performance indicators (sections 6 and 7 overleaf). • External opinion: Willis Towers Watson conducted a review of our risk management arrangements and provided us with a report in December 2024 on the outcomes; these were reported by our Chief Auditor to the Audit, Risk & Scrutiny Board in 2025. WTW’s opinion was that: “Renfrewshire Council has a well-established approach to risk management with many positive features, especially in terms of strong governance and a positive cultural attitude towards risk management at a corporate level. “The BAURAM (Business-as-usual risk assurance model, © Renfrewshire Council) is an innovative and powerful approach which has been designed well and, like many other elements of Renfrewshire Council’s risk approach, is evidently subject to continuous improvement. “To continue to grow risk management maturity, Renfrewshire Council may wish to focus on ensuring sufficient resources – both in terms of personnel and systems - are available to ensure risks are identified promptly, recorded consistently and therefore managed appropriately.” 5. Target State/ Future Vision In working to our objectives and the recommendations made by Willis Towers Watson, we will ensure continuous improvement in our risk management arrangements with the goal always being that good risk management protects us and adds value, with measures of success that include positive financial outcomes, delivery of business objectives, positive project outcomes, positive feedback from external scrutiny, fewer unexpected problems, fewer incidents, accidents or complaints, and fewer insurance claims/ less litigation. In terms of risk management maturity, we aim to demonstrate that risk management arrangements are embedded consistently throughout the organisation and that risk methodologies along with a positive risk culture are helping drive effective outcomes and decision making. For example, using risk management effectively in service planning, financial planning, project management, performance management etc will produce better and more sustainable outcomes for the organisation and protect valuable resources. 6. Strategic Initiatives / Key Actions An important component of our risk management arrangements is our Strategic Risk Management Development Plan (SRMDP). This Plan sets out improvement activity over a two-year cycle, that will take us from our ‘current state’ to our ‘target state/ future vision.’ The Plan also accounts for where our performance against our key performance metrics/ KPIs could be stronger, with actions directly addressing any improvements required under each of our risk management objectives. Progress against the SRMPD is reported to the Audit, Risk & Scrutiny Board annually as part of the risk management annual report.
Page 10
Appendix 1 Risk Matters v16.0 Effective from 01/04/2026 To review 01/11/2027 Lead Reviewer – Strategic Risk & Ins. Services Mgr. 4 PUBLIC 7. Performance Metrics / KPIs The Strategic Risk & Insurance Services Manager will ensure that corporate performance information is regularly reviewed to identify any emerging risks and that these are effectively captured and reported to the Audit, Risk & Scrutiny Board as part of the cycle of 6 monthly risk reports. The Corporate Risk Management Group will collectively review KPIs specifically linked to Risk Matters so that corporate and service compliance with these indicators is understood and acted on if required. Performance against these metrics will be included in the risk management annual report. 8. Resource Allocation Resources for managing risks should be met within allocated service department budgets. The Director of Finance and Resources will ensure sufficient resources for the corporate risk team. The corporate risk team will ensure sufficient training and information systems are available for colleagues to manage risk well. 9. Communicating risk management information Risk management information will be available to all colleagues via the council’s website and the Audit, Risk & Scrutiny Board pages. All colleagues will be able to flag potential new risks via a “Raise-a-Risk” QR code set up for this purpose, making it easy for colleagues (on and off our network), to engage in risk identification. Risk training will be available to staff in different forms (online and in person), making our risk courses accessible to all. Service risk management representatives will be key contacts within each service department for communicating risk information within services and corporately via the Corporate Risk Management Group. 10. Review of Risk Matters Risk Matters will be reviewed every two years by the Audit, Risk & Scrutiny Board (ARSB), with an interim review conducted by the Corporate Risk Management Group (CRMG). The next interim review will be undertaken by the CRMG in November 2026, and full review by the ARSB in November 2027.