Risk Management Annual Report 2023-2024_FINAL
Renfrewshire Council · 20 May 2024
Back to Audit, Risk and Scrutiny Board — 20 May 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Page 1 of 2 ___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 20 May 2024 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: Risk Management Annual Report 2023/2024 ___________________________________________________________________ 1. Summary 1.1 1.2 1.3 This paper presents the Risk Management Annual Report for 2023/2024 (Appendix 1). The Report describes the corporate risk management activity that has taken place during 2023/2024 in relation to the council’s risk management arrangements and strategic risk management objectives. It is not the purpose of this paper to report on the management of specific risks as such information is already provided separately to the Board in the Risk Report, May 2024 paper. In exceptionally challenging times and with diminishing resources, the council continues to apply an appropriate level of risk management to prevent or mitigate the effects of loss or harm. In doing so, we recognise that good risk management contributes to the delivery of better financial outcomes, business objectives, better project success rates, achievement of targets and fewer unexpected problems. We purposefully promote a risk aware culture and strive to place risk management information at the heart of the key decisions that we make. Our risk appetite is ‘cautious’ meaning that we can take an effective approach to managing risk in a way that both addresses our significant challenges but also enables innovation. ___________________________________________________________________ 2. Recommendations 2.1 It is recommended that the Board considers the content of the Annual Report, noting the robustness of the council’s risk management arrangements and the significant contribution that it makes with regards to the council’s corporate governance arrangements.
Page 2
Page 2 of 2 ___________________________________________________________________ 3. Background 3.1 In keeping with the ‘Scheme of Delegated Functions’ a Risk Management Annual Report is provided to the Audit, Risk and Scrutiny Board each year for consideration. The report supports the council’s code of corporate governance and seeks to provide assurance to stakeholders (internal and external) concerning the comprehensive risk management arrangements in place at the council. _________________________________________________________________ __ Implications of the report 1. Financial – not relevant to report recommendations 2. HR & Organisational Development – not relevant to report recommendations 3. Community/Council Planning – effective risk management supports the delivery of all community/ council plan outcomes 4. Legal – not relevant to report recommendations 5. Property/Assets – not relevant to report recommendations 6. Information Technology – not relevant to report recommendations 7. Equality & Human Rights – not relevant to report recommendations 8. Health & Safety – not relevant to report recommendations 9. Procurement – not relevant to report recommendations 10. Risk – as per the subject matter of this report 11. Privacy Impact – not relevant to report recommendations 12. Cosla Policy Position – not relevant to report recommendations 13. Climate Risk – not relevant to report recommendations ___________________________________________________________________ List of Background Papers (a) Non applicable – reports provided on a year-by-year basis ___________________________________________________________________ Author: Karen Locke Risk Manager riskmanager@renfrewshire.gov.uk
Page 3
Document Title: Risk Management Annual Report 2023/2024 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 20 May 2024 Review Dates: Not applicable Appendix 1 Risk Management Annual Report 2023 - 2024
Page 4
Document Title: Risk Management Annual Report 2023/2024 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 20 May 2024 Review Dates: Not applicable CONTENT 1. Introduction ........................................................................................................................................... 1 2. Risk Management Framework 2023/24: Overview ............................................................................... 1 3. Risk Management Infrastructure/ Enablers ........................................................................................... 1 4. Risk Management Process ..................................................................................................................... 3 5. Risk Management Application/ Results ................................................................................................. 4 6. Reporting and Monitoring ..................................................................................................................... 4 7. Risk Management Function/ Training and Development ...................................................................... 5 8. Conclusion ............................................................................................................................................. 5
Page 5
1 Document Title: Risk Management Annual Report 2023/2024 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 20 May 2024 Review Dates: Not applicable 1. Introduction 1.1 The Risk Management Annual Report is provided to the Audit, Risk and Scrutiny Board each year in keeping with its delegated function of considering the corporate risk management annual report. The Report describes the corporate- led risk management activity that has taken place during 2023/24 in relation to the council’s risk management arrangements and strategic risk management objectives. The Report does not cover the management of specific risks as such information is already provided separately to the Board in the Risk Report, May 2024 paper. 1.2 In exceptionally challenging times and with diminishing resources, the council continues to apply an appropriate level of risk management to prevent or mitigate the effects of loss or harm. In doing so, we recognise that good risk management contributes to the delivery of better financial outcomes, business objectives, better project success rates, achievement of targets and fewer unexpected problems. 1.3 We purposefully promote a risk aware culture and strive to place risk management information at the heart of the key decisions that we make. Our risk appetite is ‘cautious’ meaning that we can take an effective approach to managing risk in a way that both addresses our significant challenges but also enables innovation. 1.4 This annual report supports the council’s code of corporate governance and seeks to provide assurance to stakeholders (internal and external) concerning the comprehensive risk management arrangements in place at the council. 2. Risk Management Framework 2023/24: Overview 2.1 Below is an overview of the key components of the council’s risk management framework. Thereafter sections 3 to 7 of this report expand on each component and highlight specific points relevant to 2023/24 developments. (1) Infrastructure/ enablers At the heart of the council’s risk management arrangements are the strategic risk management objectives, the risk management policy and strategy and the strategic risk management development plan. Also embedded within the infrastructure are the communications systems in use for risk management information, the Intranet and the key policy boards and groups such as the Corporate Management Team and Corporate Risk Management Group that have a specific role in risk management. (2) Process A cyclical process for risk assessment, treatment, communication, monitoring and review of risk using a standardised risk matrix. The process and supporting matrix continue to enable a consistent approach to risk management throughout the council, set within the context of the council’s capacity and tolerance for risk, sometimes also referred to as ‘risk appetite.’ (3) Application/ results Risk management is not viewed as an isolated function or practice but is applied to other key business processes of the council, including service planning, financial planning, performance management, procurement, project management and partnerships. Applying risk management at the right time and in the right way is key to risk management adding value to the organisation and delivering tangible results. (4) Reporting and monitoring Reporting and monitoring arrangements, including individual and group roles and responsibilities for risk management, are defined in such a way as to ensure a suitable flow of risk management information throughout the council and an appropriate level of monitoring and scrutiny relating to the effectiveness of the risk management arrangements in place and progress being made in relation to activity linked to strategic and corporate risk registers and service risk management plans. (5) Risk management function For the risk management framework to be effective, it must be underpinned by training, guidance and ongoing development activity which raise awareness of how to implement good risk management practice across the council. This aspect of the framework informs the workplan of the corporate risk management function under the responsibility of the Director of Finance and Resources. 3. Risk Management Infrastructure/ Enablers
Page 6
2 Document Title: Risk Management Annual Report 2023/2024 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 20 May 2024 Review Dates: Not applicable 3.1 Risk Management Policy and Strategy In November 2023 ‘Risk Matters’ the combined risk management policy and strategy was revised and approved by the Audit, Risk and Scrutiny Board1. At its formal review there were no material changes proposed to Risk Matters, and only one minor amendment was made to reflect a change in terminology for the council’s risk appetite, as being risk cautious. Policy and strategy reviewed and approved within schedule. 3.2 Strategic Risk Management Objectives The council bases its strategic risk management objectives around the former National Risk Management Performance Assessment Model developed by ALARM2. The strategic risk management objectives remain relevant and continue to form the basis of our Strategic Risk Management Development Plan. 3.3 Strategic Risk Management Development Plan To support the implementation of ‘Risk Matters’ and the continuous improvement of risk management practice within the council, a Strategic Risk Management Development Plan (the Plan), is in place, outlining key actions that require to be completed over the life cycle of Risk Matters. The Plan is accessible to all Corporate Risk Management Group members via the Group’s MS Teams channel. Performance against the Plan is reported as follows: YEAR 1, 2022-23 Key performance figure - 100%, (30 of 30 actions) complete, against an 85% in-year target YEAR 2, 2023-24 Key performance figure - 88%, (14 of 16 actions) complete, against an 85% in-year target FULL PLAN, 2022-24 Key performance figure - 96%, (44 of 46 actions) complete, against an 85% target 3.4 The Corporate Risk Management Group (CRMG) (1) The Group meets 6 weekly for ‘Risk Pulse’ ensuring all members are aware of developing/ emerging areas of risk and how this might impact on various risk registers. The key purpose of this meeting is to share good practice, be aware of each other’s risk context (thus promoting corporate working) and identify new and emerging risks. Risk Pulse performance has been in line with strategy/ corporate expectations. (2) The Group also meets on an ad hoc basis for ‘Risk Bite’ where meetings are arranged to ensure progress against key milestones such as ensuring risks are reviewed and reports provided timeously to Board, or, another example is monitoring implementation of the council’s new Business as Usual Risk Assurance Model (working title: BaURAM © Renfrewshire Council). Risk Bite performance has been in line with strategy/ corporate expectations. 1 Risk Matters is reviewed formally every two years by Board with an interim annual review conducted by the Corporate Risk Management Group. 2 ‘ALARM’ is the public sector risk management association. The council’s Risk Manager is a Board Director of ALARM.
Page 7
3 Document Title: Risk Management Annual Report 2023/2024 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 20 May 2024 Review Dates: Not applicable (3) The final core aspect of activity is ‘Risk Dive’ where the purpose is to carry out an in-depth analysis of a specific risk to form an opinion as to whether the risk is over, under or well controlled, and take forward any improvement actions required. Risk Dive performance has not been as expected during 2023/24. The Board should note that a significant amount of risk management development work has been progressed over 2023/24 and so limited capacity in the Risk team meant that Risk Dive had to be set aside in favour of pursuing other priorities. It is intended that Risk Dive will recommence in 2024/25. New in 2023/24: The Corporate Management Team undertook a review of CRMG membership. To ensure that senior colleagues across services are involved in the identification of risk, contribute to focused conversations about risk and promote risk management initiatives, Directors nominated at least one Head of Service from each service department to take on the role of lead risk rep. 3.5 The website and intranet The intranet has historically been home to our risk management information and has been a key tool for communicating and providing risk management information and guidance for all staff with access to it. New in 2023/24: Recognising that not all staff can access the intranet and also that over the past year there has been significant external interest in the council’s risk management arrangements, a new public-facing risk management page has been developed on the council’s website, making risk information much more accessible. 4. Risk Management Process 4.1 The table below summarises the guidance which accompanies the risk management process. Applying this process in all aspects of business helps officers to manage their activities and pursue opportunities in a way that helps achieve objectives and prevent loss or harm. Establish the context Services consider risk in terms of context such as key themes and objectives, service priorities, operational activities or projects, longer-term or shorter-term objectives. Identify risk Services carefully define their risks in such a way as to be clear about the situation presented (opportunity, activity, service change, problem or challenge) and the consequences that may flow from it. We use risk ‘bowtie’ analysis which employees are finding very visual and helpful in understanding risk. Analyse risk Services analyse risk in terms of likelihood of occurrence and should it occur, its potential impact using the standardised risk matrix. Evaluate risk Services evaluate risk in terms of significance, being either ‘low’, ‘moderate’, ‘high’ or ‘very high’ and compare this with the council’s capacity and tolerance for risk. Treat risk Services consider a range of options when deciding on the most appropriate way to address their risks, either through measures to terminate; transfer elsewhere (such as through insurance); tolerate as it is; or, treat with cost effective measures to reduce it to a level where the exposure is acceptable or tolerable for the council in keeping with its capacity and tolerance for risk. Note: in the case of opportunities, services may ‘take’ an informed risk in terms of tolerating it if an opportunity is judged to be (1) worthwhile pursuing and (2) the service is confident in its ability to achieve the benefits and justify the risk. Monitor and review risk Services are aware that once a risk assessment has been undertaken it is necessary to continue to monitor and review the risk for changes in context or the measures that are in place to control it. Communicate and consult Services are aware that it is good practice for at least two officers with relevant subject knowledge to undertake risk assessment (in consultation with other officers if necessary) with the key outcomes of the risk assessment process communicated to relevant persons (such as using the risk implications section on Board papers). The standardised process for risk management within the council remains fit for purpose. The steps in the process have been embedded in the council’s new online risk management course.
Page 8
4 Document Title: Risk Management Annual Report 2023/2024 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 20 May 2024 Review Dates: Not applicable 5. Risk Management Application/ Results 5.1 For risk management to truly add value for the organisation, it needs to be applied across the range of business processes in operation throughout the council and all its service departments. This section provides an outline of how this happens in practice across a range of business practices. 5.2 Risk management continues to be a key component of the council's programme and project management arrangements meaning that if risks are proactively addressed through each stage of a project, the desired outcomes are more likely to be achieved, on time and within the planned budget. New in 2023/24: the Risk Manager delivered project risk management training with all Programme Management Unit colleagues (in a train the trainer format) enabling colleagues to deliver this as part of project kick-offs to support a more risk focused culture in the organisation. 5.3 Each service continues to monitor their risks and refresh them annually, taking account of the service priorities and service improvement plans. This means that risks relating to the service priorities are proactively addressed and services are more likely to achieve their priorities and outcomes as planned. 5.4 Each year, services bring to the attention of the Director of Finance and Resources any areas of unavoidable cost pressures they are experiencing. During this process services can highlight instances where cost pressures relate to risks, and this supports effective decisions to be made in financial planning. 5.5 For risk assurance, as reported last year a new risk assurance model was developed post approval by the Corporate Management Team in 2021, ready to go live in April 2023. New in 2023/24: The new Business as Usual Risk Assurance Model (working title: BaURAM © Renfrewshire Council) went live as planned in April 2023. The outputs from the model are being reported to the Audit, Risk & Scrutiny Board as per the 6 monthly risk reporting requirements and separately by the Chief Auditor in relation to annual governance assurance levels. The new model also facilitates the escalation of corporate gaps in relation to some areas of activity with a corporate gap tracker also being reported to Board as part of the model. 6. Reporting and Monitoring 6.1 The governance arrangements in place during 2023/24 have continued to ensure clear lines of accountability for risk management and continue to enable a suitable flow of risk information throughout the council. The Audit, Risk & Scrutiny Board received risk progress reports on time in May and November 2023. 6.2 Each service has a representative on the Corporate Risk Management Group (the Group). The Group has overseen the 2023/24 strategic and corporate risks, monitoring progress. Services have taken ownership of their risks with processes being followed for reporting, and where necessary ‘escalation’ of significant risks to the Group. All service departments submitted their risk data on time for the progress reports to the Audit, Risk and Scrutiny Board as planned. 6.3 The Corporate Risk Management Group continues to operate in a way that is more dynamic in terms of monitoring risk activity across various risk registers and the Business as Usual Risk Assurance Model. 6.4 In terms of monitoring performance in risk management the council historically participated in the ALARM/ CIPFA3 benchmarking club, using ALARM’s National Risk Management Performance Assessment Model. Although the benchmarking club no longer exists the risk maturity model attached to it still does, describing maturity as: ▪ Level 1 Awareness ▪ Level 2 Happening ▪ Level 3 Working ▪ Level 4 Embedded and integrated ▪ Level 5 Driving The council aims for and is performing at level 4. There is the possibility that the Performance Assessment Model will be updated and so the council will review its performance against the revised model if/ when released to ALARM members. 3 Chartered Institute for Public Finance and Accountancy.
Page 9
5 Document Title: Risk Management Annual Report 2023/2024 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 20 May 2024 Review Dates: Not applicable 6.5 In relation to Key Performance Indicators for risk management, as previously reported in 2022/23, the set of indicators previously in place were set aside on the basis that they had been superseded by the development work of the previous 2 years. Last year we reported that new indicators would require to be established towards the end of 2024/25 for implementation in 2024/25. New in 2023/24: New KPIs have been agreed for implementation in 2024/25: • % service departments represented at each risk ‘pulse’ (6 weekly) • % service departments meeting online risk module target (annual, with ¼ly review) • % Strategic RM Development Plan actions met against target (annual, with ¼ly review) • % risk modules showing reasonable or substantial assurance (annual with ¼ly review) • % deep dive exercises undertaken against target (annual with ¼ly review) • % service departments reviewing full service risk profile on ¼ basis (quarterly review) • % service departments undertaking horizon scanning, 6 monthly (6 monthly review) • % 'Whose risk it anyway' delegate feedback (score 4 or above) (per course) 7. Risk Management Function/ Training and Development 7.1 The council’s Risk Management Training Strategy ensures we are clear about the council’s expectations as to the degree of risk management knowledge required across a range of roles within the council, and the risk management training and development solutions that are available and should be accessed through the council to enable competence and capacity to manage risk within those roles. Training strategy updated to reflect new courses developed in 2023/24. 7.2 Over the course of 2023/24 the following has been delivered: ▪ Risk and insurance session for CPU colleagues ▪ Risk assurance briefing for CE senior management team ▪ Risk briefing for Finance and Resources senior management team ▪ Project risk management session for learning estate solutions ▪ Train the trainer session with the Programme Management Unit ▪ Bespoke risk management session/s for business management students ▪ Risk session for CMT (extended) along with legal, PMU colleagues and Zurich Municipal consultant ▪ Risk session for Leadership Development Programme in conjunction with SOLACE ▪ Whose risk is it anyway? 7.3 Ad hoc support, advice or training requests continue to be met so far as reasonably practical. 7.4 To continue to provide evidenced based training, development and advice for the council, the council’s Risk Manager maintains continued professional development in her field and is qualified to Masters Level (MSc in Risk Management awarded by Glasgow Caledonian University). 7.5 Through membership of some groups and organisations that include ALARM (the Public Risk Management Association), the Risk Manager keeps abreast of risk management developments and best practice in other public- sector organisations and local authority areas. The Risk Manager now sits on the ALARM Board and is presently serving a two year term as ALARM President. This role means greater development opportunities that in turn serve the council well. 7.6 Through the council’s contracts with Insurers and Insurance Brokers, the Risk and Insurance Team keep up to date with developments in the insurance sector in order to ensure that the council’s insurance interests and liabilities are protected so far as possible. New in 2023/24: Three new courses developed: Introduction to risk management (online), Whose Risk is it Anyway? (in-person), and Insurance guide for procurement activities (online). 8. Conclusion 8.1 This Report has provided an overview of risk management arrangements and activity relating to 2023/24 in regard to the council’s corporate-led risk management approach. It is intended that the report provides assurance to the Board.