7 Risk Management Annual Report 2025-2026
Renfrewshire Council · 18 May 2026
Back to Audit, Risk and Scrutiny Board — 18 May 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Page 1 of 2 PUBLIC __________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 18 May 2026 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: Risk Management Annual Report 2025/2026 ___________________________________________________________________ 1. Summary 1.1 1.2 1.3 This paper presents the Risk Management Annual Report for 2025/2026 (Appendix 1). The Report describes the corporate risk management activity that has taken place during 2025/2026 in relation to the council’s risk management arrangements and strategic risk management objectives. It is not the purpose of this paper to report on the management of specific risks as such information is already provided separately to the Board in the Risk Report, May 2026 paper. In exceptionally challenging times and with constrained resources, the council continues to apply an appropriate level of risk management to prevent or mitigate the effects of loss or harm. In doing so, we recognise that good risk management contributes to the delivery of better service and financial outcomes, business objectives, better project success rates, achievement of targets and fewer unexpected problems. We purposefully promote a risk aware culture and strive to place risk management information at the heart of the key decisions that we make. Overall, our risk appetite is ‘cautious’ however this can change from objective to objective. We take an effective approach to managing risk in a way that addresses our significant challenges but also enables innovation. ___________________________________________________________________ 2. Recommendations 2.1 It is recommended that the Board considers the content of the Annual Report, noting the robustness of the council’s risk management arrangements and the significant contribution that it makes with regards to the council’s corporate governance arrangements. ___________________________________________________________________
Page 2
Page 2 of 2 PUBLIC 3. Background 3.1 In keeping with the ‘Scheme of Delegated Functions’ a Risk Management Annual Report is provided to the Audit, Risk and Scrutiny Board each year for consideration. The report supports the council’s code of corporate governance and seeks to provide assurance to stakeholders (internal and external) concerning the comprehensive risk management arrangements in place at the council. ___________________________________________________________________ Implications of the report 1. Financial – not relevant to report recommendations 2. HR & Organisational Development – not relevant to report recommendations 3. Community/Council Planning – not relevant to report recommendations 4. Legal – not relevant to report recommendations 5. Property/Assets – not relevant to report recommendations 6. Information Technology – not relevant to report recommendations 7. Equality & Human Rights – not relevant to report recommendations 8. Health & Safety – not relevant to report recommendations 9. Procurement – not relevant to report recommendations 10. Risk – as per the subject matter of this report 11. Privacy Impact – not relevant to report recommendations 12. Climate Risk – not relevant to report recommendations 13. Children’s Rights – This report does not present a new policy, function, or strategy, nor a substantive change to an existing policy, function or strategy which will have an impact on children’s rights. The report itself is therefore largely neural on children. However, our risk management arrangements extend to the management of certain risks which support a number of the Articles contained within the United Nations Convention on the Rights of the Child (Incorporation) (Scotland) Act 2024. For example, managing the risk relating to ‘Community and Public Safety’ supports Articles: • 19 – protection from violence; 34 – protection from sexual abuse; 35 – protection from sale and trafficking; and 36 – protection from exploitation 14. Cosla Policy Position – not relevant to report recommendations ___________________________________________________________________ List of Background Papers (a) Non applicable – reports provided on a year-by-year basis ___________________________________________________________________ Author: Karen Locke (riskmanagement@renfrewshire.gov.uk) Strategic Risk & Insurance Services Manager
Page 3
Document Title: Risk Management Annual Report 2025/2026 Service: N/A Lead Author Strategic Risk & Insurance Services Manager Date Effective: 18 May 2026 Review Dates: Not applicable PUBLIC Appendix 1 Risk Management Annual Report 2025 - 2026
Page 4
Document Title: Risk Management Annual Report 2025/2026 Service: N/A Lead Author Strategic Risk & Insurance Services Manager Date Effective: 18 May 2026 Review Dates: Not applicable PUBLIC CONTENT 1. Introduction ........................................................................................................................................... 1 2. Risk Management Framework 2025/26: Overview ............................................................................... 1 3. Risk Management Infrastructure/ Enablers ........................................................................................... 2 4. Risk Management Process ..................................................................................................................... 3 5. Risk Management Application/ Results ................................................................................................. 4 6. Reporting and Monitoring ..................................................................................................................... 4 7. Risk Management Function/ Training and Development ...................................................................... 5 8. Conclusion ............................................................................................................................................. 5
Page 5
1 Document Title: Risk Management Annual Report 2025/2026 Service: N/A Lead Author Strategic Risk & Insurance Services Manager Date Effective: 18 May 2026 Review Dates: Not applicable PUBLIC 1. Introduction 1.1 The Risk Management Annual Report is provided to the Audit, Risk and Scrutiny Board each year in keeping with its delegated function of considering the corporate risk management annual report. The Report describes the corporate- led risk management activity that has taken place during 2025/26 in relation to the council’s risk management arrangements and strategic risk management objectives. The Report does not cover the management of specific risks as such information is already provided separately to the Board in the Risk Report, May 2026 paper. 1.2 In exceptionally challenging times and with constrained resources, the council continues to apply an appropriate level of risk management to prevent or mitigate the effects of loss or harm. In doing so, we recognise that good risk management contributes to the delivery of better service and financial outcomes, business objectives, better project success rates, achievement of targets and fewer unexpected problems. 1.3 We purposefully promote a risk aware culture and strive to place risk management information at the heart of the key decisions that we make. Overall, our risk appetite is ‘cautious’ however this can change from objective to objective. We take an effective approach to managing risk in a way that addresses our significant challenges but also enables innovation. 1.4 This annual report supports the council’s code of corporate governance and seeks to provide assurance to stakeholders (internal and external) concerning the risk management arrangements in place at the council. 2. Risk Management Framework 2025/26: Overview 2.1 Below is an overview of the key components of the council’s risk management framework. Thereafter sections 3 to 7 of this report expand on each component and highlight specific points relevant to 2025/26 activity. (1) Infrastructure/ enablers At the heart of the council’s risk management arrangements are the strategic risk management objectives, the risk management policy and strategy and the strategic risk management development plan. Also embedded within the infrastructure are the communications systems in use for risk management information, the Intranet and the key policy boards and groups such as the Corporate Management Team and Corporate Risk Management Group that have a specific role in risk management. (2) Process A cyclical process for risk assessment, treatment, communication, monitoring and review of risk using a standardised risk matrix. The process and supporting matrix continue to enable a consistent approach to risk management throughout the council, set within the context of the council’s appetite and tolerance for risk. (3) Application/ results Risk management is not viewed as an isolated function or practice but is applied to other key business processes of the council, including service planning, financial planning, performance management, procurement, project management and partnerships. Applying risk management at the right time and in the right way is key to risk management adding value to the organisation and delivering tangible results. (4) Reporting and monitoring Reporting and monitoring arrangements, including individual and group roles and responsibilities for risk management, are defined in such a way as to ensure a suitable flow of risk management information throughout the council and an appropriate level of monitoring and scrutiny relating to the effectiveness of the risk management arrangements in place and progress being made in relation to activity linked to strategic, corporate, service and business as usual risks. (5) Risk management function For the risk management framework to be effective, it must be underpinned by training, guidance and ongoing development activity which raise awareness of how to implement good risk management practice across the council. This aspect of the framework informs the workplan of the corporate risk management function under the responsibility of the Director of Finance and Resources.
Page 6
2 Document Title: Risk Management Annual Report 2025/2026 Service: N/A Lead Author Strategic Risk & Insurance Services Manager Date Effective: 18 May 2026 Review Dates: Not applicable PUBLIC 3. Risk Management Infrastructure/ Enablers 3.1 Risk Management Policy and Strategy Risk Matters, the combined risk management policy and strategy is reviewed formally every two years by the Audit, Risk & Scrutiny Board with an interim annual review conducted by the Corporate Risk Management Group. The latest version of Risk Matters was agreed by the Corporate Management Team in March 2026 and has been submitted to the ARSB for approval May 2026. The revised policy and strategy reflect recommendations made by Willis Towers Watson who undertook an independent review of the council’s risk management arrangements, on behalf of Internal Audit (the findings were reported to Board by the Chief Auditor in 2025). 3.2 Strategic Risk Management Objectives The council bases its strategic risk management objectives around the former National Risk Management Performance Assessment Model developed by ALARM1. The strategic risk management objectives remain relevant and continue to form the basis of our Strategic Risk Management Development Plan. 3.3 Strategic Risk Management Development Plan To support the implementation of ‘Risk Matters’ and the continuous improvement of risk management practice within the council, a Strategic Risk Management Development Plan (the Plan), is in place, outlining key actions that require to be completed over the life cycle of Risk Matters. Performance against the Plan is reported as follows: YEAR 1, 2024-25 Key performance figure - 100%, (12 of 12 actions) complete, against an 85% in-year target YEAR 2, 2025-26 Key performance figure - 89%, (08 of 09 actions) complete, against an 85% in-year target FULL PLAN, Key performance figure - 95%, (20 of 21 actions) complete, against an 85% 2-year target 3.4 The Corporate Risk Management Group (CRMG) (1) The Group meets 6 weekly for ‘Risk Pulse’ ensuring all members are aware of developing/ emerging areas of risk and how this might impact on various risk registers. The key purpose of this meeting is to share good practice, be aware of each other’s risk context (promoting corporate working) and identify new and emerging risks. (2) The Group also meets on an ad hoc basis for ‘Risk Bite’ where meetings are arranged to ensure progress against key milestones such as ensuring risks are reviewed and reports provided timeously to Board. (3) The final core aspect of activity is ‘Risk Dive’ where the purpose is to carry out an in-depth analysis of a specific risk to form an opinion as to whether the risk is over, under or well controlled, and take forward any improvement actions required. The format for gathering risk data this year to support a new risk template, effectively meant that all strategic and corporate risks underwent a deep dive. For future years, we will once again revert to the methodology adopted whereby a couple of risks are selected and related assumptions are tested. 1 ‘ALARM’ is a member association for risk professionals working (mostly) in the UK public sector. The council’s Strategic Risk & Insurance Services Manager is a Board Director of ALARM.
Page 7
3 Document Title: Risk Management Annual Report 2025/2026 Service: N/A Lead Author Strategic Risk & Insurance Services Manager Date Effective: 18 May 2026 Review Dates: Not applicable PUBLIC 3.5 Information and communication The council’s website continues to be the main channel through which colleagues and indeed the public can access information about our risk management arrangements. Information about the council’s insurance arrangements is available to colleagues via the intranet. The Corporate Management Group has access to further in-depth material through its extensive use of a dedicated MS Teams channel and sub channels. While risk register data is collated for reporting within the MS Teams channel, going forward there will be development undertaken to systemise this data. New in 2025/26: Corporate Gap Tracker - while completing business-as-usual risk assurance modules, Chief Officers have an opportunity to highlight anything they believe to be a corporate gap in terms of risk controls. Working with ICT colleagues, the risk and internal audit teams have developed and implemented an in-house tracker, which enables the Chief Auditor to see how relevant subject matter experts have responded when a perceived gap has been highlight. The tracker ensures the monitoring of these potential gaps until they are adequately addressed. In progress: We continue to explore a best value solution for systemising our risk information. The preferred option is still to be determined (to build a system in-house or work with an existing commercial supplier to ensure their solution is fit for purpose). 4. Risk Management Process 4.1 The table below summarises the guidance which accompanies the risk management process. Applying this process in all aspects of business helps officers to manage their activities and pursue opportunities in a way that helps achieve objectives and prevent loss or harm. Establish the context Services consider risk in terms of context such as key themes and objectives, service priorities, operational activities or projects, longer-term or shorter-term objectives. Identify risk Services carefully define their risks in such a way as to be clear about the situation presented (opportunity, activity, service change, problem or challenge) and the consequences that may flow from it. We use risk ‘bowtie’ analysis which employees are finding very visual and helpful in understanding risk. Analyse risk Services analyse risk in terms of likelihood of occurrence and should it occur, its potential impact using the adopted corporate risk matrix. Evaluate risk Services evaluate risk in terms of significance, being either ‘low’, ‘moderate’, ‘high’ or ‘very high’ and compare this with the council’s appetite and tolerance for risk. Treat risk Services consider a range of options when deciding on the most appropriate way to address their risks, either through measures to terminate; transfer elsewhere (such as through insurance); tolerate as it is; or treat with cost effective measures to reduce it to a level where the exposure is acceptable or tolerable for the council in keeping with its capacity and tolerance for risk. Note: in the case of opportunities, services may ‘take’ an informed risk in terms of tolerating it if an opportunity is judged to be (1) worthwhile pursuing and (2) the service is confident in its ability to achieve the benefits and justify the risk. Monitor and review risk Services are aware that once a risk assessment has been undertaken it is necessary to continue to monitor and review the risk for changes in context or the measures that are in place to control it. Communicate and consult Services are aware that it is good practice for at least two officers with relevant subject knowledge to undertake risk assessment (in consultation with other officers if necessary) with the key outcomes of the risk assessment process communicated to relevant persons (such as using the risk implications section on Board papers). The process outlined above remains fit for purpose. The steps in the process are embedded in the council’s online risk management course. New in 2025/26: Identifying risk – a QR code (with supporting MS Form), has been developed to enable anyone with a valid employee number (networked and non/ networked), to be able to ‘Raise-a-Risk.’ On completing a few details, the form then flows to the correct service risk rep for review and possible inclusion in the relevant risk register.
Page 8
4 Document Title: Risk Management Annual Report 2025/2026 Service: N/A Lead Author Strategic Risk & Insurance Services Manager Date Effective: 18 May 2026 Review Dates: Not applicable PUBLIC 5. Risk Management Application/ Results 5.1 For risk management to truly add value for the organisation, it needs to be applied across the range of business processes in operation throughout the council and all its service departments. This section provides an outline of how this happens in practice across a range of business practices. 5.2 Risk management continues to be a key component of the council's programme and project management arrangements meaning that if risks are proactively addressed through each stage of a project, the desired outcomes are more likely to be achieved, on time and within the planned budget. 5.3 Each service continues to monitor their risks and refresh them annually, taking account of the service priorities and service improvement plans. This means that risks relating to the service priorities are proactively addressed and services are more likely to achieve their priorities and outcomes as planned. 5.4 Each year, services bring to the attention of the Director of Finance and Resources any areas of unavoidable cost pressures they are experiencing. During this process services can highlight instances where cost pressures relate to risks, and this supports effective decisions to be made in financial planning. 5.5 For risk assurance, all Heads of Service (and direct reports to Directors), undertake self-assessment with the Business-as-Usual Risk Assurance Model (BaURAM © Renfrewshire Council), developed in house and first launched in April 2023. The outputs from the model are reported to the Audit, Risk & Scrutiny Board as per the 6 monthly risk reporting requirements and separately by the Chief Auditor in relation to annual governance assurance levels. BaURAM is now in its 3rd year of operation and continues to add value to our assurance arrangements. 6. Reporting and Monitoring 6.1 The governance arrangements in place during 2025/26 have continued to ensure clear lines of accountability for risk management and continue to enable a suitable flow of risk information throughout the council. The Audit, Risk & Scrutiny Board received risk progress reports as planned in May and November 2025. New in 2025/26: The Risk and Insurance Team transferred from Internal Audit Services to Business Services under the leadership of the new Head of Business Services, Risk & Safety. New in 2025/26: Following on from the Willis Towers Watson report, the risk team has expanded to recruit a new Corporate Risk Officer post, reporting to the Strategic Risk & Insurance Services Manager. 6.2 Each service has at least one representative on the Corporate Risk Management Group (the Group), and at least one representative from each service is always a Head of Service. The Group has overseen the 2025/26 strategic and corporate risks, monitoring progress. Services have taken ownership of their risks with processes being followed for reporting, and where necessary ‘escalation’ of significant risks to the Group. All service departments submitted their risk data on time for the 6 monthly progress reports to the Audit, Risk and Scrutiny Board as planned. 6.3 The Corporate Risk Management Group continues to operate in a way that is more dynamic in terms of monitoring risk activity across various risk registers and the Business-as-Usual Risk Assurance Model. 6.4 In terms of monitoring performance in risk management, when Willis Towers Watson undertook their review of our risk management arrangements, they concluded that the council was ‘leading’ in areas of governance and culture, ‘established’ in the areas of strategy, risk reporting and monitoring, risk analysis and evaluation, and risk response, and ‘developing’ in the areas of risk identification and the risk control environment. Council performance in the ‘developing’ areas has improved through the introduction of the QR code for risk identification and the corporate gap tracker for the risk control environment. 6.5 The council has a number of risk management Key Performance Indicators that it monitors in order to see how risk management is being embedded across the organisation. Performance at year end was as follows.
Page 9
5 Document Title: Risk Management Annual Report 2025/2026 Service: N/A Lead Author Strategic Risk & Insurance Services Manager Date Effective: 18 May 2026 Review Dates: Not applicable PUBLIC 89% Strategic RM Development Plan actions completed in year (annual, target 85%) (24/25, 100%) 95% Strategic RM Development Plan actions completed – full 2yr plan (2yr target 85%) 100% service departments undertaking horizon scanning, 6 monthly (6 monthly, target 100%) 100% 'Whose risk it anyway' delegate feedback (scoring 4 or above) (per course, target 85%) 100% services (SMTs) reviewing risk profiles regularly (>6 monthly) (annual, target 100%) 99.5% risk modules showing reasonable or substantial assurance (annual, target 95%) (24/25, 97%) 33% risk ‘pulse’ meetings with 100% service risk rep representation (annual, target 100%) (24/25, 50%) 100% deep dive exercises undertaken against target (annual, targ. 2 p/ann) (24/25, 50%) 82% ≥grade 9 completing the online risk module (60% in-year target) (annual, targets below) (24/25 5.4%) Yr1 30%, Yr2 60%, Yr3 90%) It is worth noting the improved performance in relation to compliance with the mandatory training target for the online risk course. % of grade 9s and above completing the course has increased significantly from 5.4% in year 1 to 82% in year 2, now ahead of target. 7. Risk Management Function/ Training and Development 7.1 The council’s Risk Management Training Strategy ensures we are clear about the council’s expectations as to the degree of risk management knowledge required across a range of roles within the council, and the risk management training and development solutions that are available and should be accessed through the council to enable competence and capacity to manage risk within those roles. 7.2 Over the course of 2025/26 the training below has been delivered, in addition to our two online courses (An introduction to risk management, and the insurance guide for procurement activities): Corporate Course* Service Specific Elected Members Other ▪ 30 May 2025 ▪ 02 October 2025 ▪ 13 November 2025 ▪ 04 December 2025 ▪ 26 March 2026 ▪ 4 April – Facility and Property Services - contractor risk and insurance ▪ 12 May – risk management for new Audit, Risk & Scrutiny Board member ▪ 12 May – training for new interim Head of Service ▪ 25 August – training for service risk reps on new risk template ▪ 02 December – training for subject matter experts on new corporate gap tracker ▪ 05 December – presentation to Scottish Local Authority Chief Internal Auditors Group on our risk assurance model * The ‘Whose Risk is it Anyway’ in-person course is now running on the last Thursday of every second month 7.3 Ad hoc support, advice or training requests continue to be met so far as reasonably practical. 7.4 To continue to provide evidenced based training, development and advice for the council, the Strategic Risk & Insurance Services Manager, and the Corporate Risk Officer maintain continued professional development in their field. Both are qualified at Masters Level in risk management and/ or related disciplines. 7.5 Through membership of ALARM, the Strategic Risk & Insurance Services Manager, and the Corporate Risk Officer keep abreast of risk management developments and best practice in other public-sector organisations and local authority areas. The Strategic Risk & Insurance Services Manager presently serves as an ALARM Board Director following a 2-year tenure as ALARM President. 7.6 Through the council’s contracts with Insurers and Insurance Brokers, the Risk and Insurance Team keep up to date with developments in the insurance sector to ensure that the council’s insurance interests and liabilities are protected so far as possible. 8. Conclusion 8.1 This Report has provided an overview of risk management arrangements and activity during 2025/26 aligned to the council’s corporate-led risk management approach. It is intended that the report provides assurance to the Board.