Risk Management Annual Report 2024-2025_FINAL
Renfrewshire Council · 19 May 2025
Back to Audit, Risk and Scrutiny Board — 19 May 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Page 2 of 4 __________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 19 May 2025 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: Risk Management Annual Report 2024/2025 ___________________________________________________________________ 1. Summary 1.1 1.2 1.3 1.4 This paper presents the Risk Management Annual Report for 2024/2025 (Appendix 1). The Report describes the corporate risk management activity that has taken place during 2024/2025 in relation to the council’s risk management arrangements and strategic risk management objectives. It is not the purpose of this paper to report on the management of specific risks as such information is already provided separately to the Board in the Risk Report, May 2025 paper. In exceptionally challenging times and with constrained resources, the council continues to apply an appropriate level of risk management to prevent or mitigate the effects of loss or harm. In doing so, we recognise that good risk management contributes to the delivery of better service and financial outcomes, business objectives, better project success rates, achievement of targets and fewer unexpected problems. We purposefully promote a risk aware culture and strive to place risk management information at the heart of the key decisions that we make. Our risk appetite is ‘cautious.’ We take an effective approach to managing risk in a way that both addresses our significant challenges but also enables innovation. This report is provided in the knowledge that in an independent review of the council’s risk management arrangements, during 2024/25, WTW (the auditors), concluded that “Renfrewshire Council has a well-established approach to risk management with many positive features, especially in terms of strong governance and a positive cultural attitude towards risk management at a corporate level.” ___________________________________________________________________ 2. Recommendations
Page 2
Page 3 of 4 2.1 It is recommended that the Board considers the content of the Annual Report, noting the robustness of the council’s risk management arrangements and the significant contribution that it makes with regards to the council’s corporate governance arrangements. ___________________________________________________________________ 3. Background 3.1 In keeping with the ‘Scheme of Delegated Functions’ a Risk Management Annual Report is provided to the Audit, Risk and Scrutiny Board each year for consideration. The report supports the council’s code of corporate governance and seeks to provide assurance to stakeholders (internal and external) concerning the comprehensive risk management arrangements in place at the council. ___________________________________________________________________ Implications of the report 1. Financial – not relevant to report recommendations 2. HR & Organisational Development – not relevant to report recommendations 3. Community/Council Planning – not relevant to report recommendations 4. Legal – not relevant to report recommendations 5. Property/Assets – not relevant to report recommendations 6. Information Technology – not relevant to report recommendations 7. Equality & Human Rights – not relevant to report recommendations 8. Health & Safety – not relevant to report recommendations 9. Procurement – not relevant to report recommendations 10. Risk – as per the subject matter of this report 11. Privacy Impact – not relevant to report recommendations 12. Climate Risk – not relevant to report recommendations 13. Children’s Rights – This report does not present a new policy, function, or strategy, nor a substantive change to an existing policy, function or strategy which will have an impact on children’s rights. The report itself is therefore largely neural on children. However, our risk management arrangements extend to the management of certain risks which support a number of the Articles contained within the United Nations Convention on the Rights of the Child (Incorporation) (Scotland) Act 2024. For example, managing the risk relating to ‘Community and Public Safety’ supports Articles: • 19 – protection from violence • 34 – protection from sexual abuse • 35 – protection from sale and trafficking • 36 – protection from exploitation 14. Cosla Policy Position – not relevant to report recommendations
Page 3
Page 4 of 4 ___________________________________________________________________ List of Background Papers (a) Non applicable – reports provided on a year-by-year basis ___________________________________________________________________ Author: Karen Locke Risk Manager riskmanager@renfrewshire.gov.uk
Page 4
Document Title: Risk Management Annual Report 2024/2025 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 19 May 2025 Review Dates: Not applicable Appendix 1 Risk Management Annual Report 2024 - 2025
Page 5
Document Title: Risk Management Annual Report 2024/2025 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 19 May 2025 Review Dates: Not applicable CONTENT 1. Introduction ........................................................................................................................................... 1 2. Risk Management Framework 2024/25: Overview ............................................................................... 1 3. Risk Management Infrastructure/ Enablers ........................................................................................... 2 4. Risk Management Process ..................................................................................................................... 3 5. Risk Management Application/ Results ................................................................................................. 4 6. Reporting and Monitoring ..................................................................................................................... 4 7. Risk Management Function/ Training and Development ...................................................................... 5 8. Conclusion ............................................................................................................................................. 6
Page 6
1 Document Title: Risk Management Annual Report 2024/2025 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 19 May 2025 Review Dates: Not applicable 1. Introduction 1.1 The Risk Management Annual Report is provided to the Audit, Risk and Scrutiny Board each year in keeping with its delegated function of considering the corporate risk management annual report. The Report describes the corporate- led risk management activity that has taken place during 2024/25 in relation to the council’s risk management arrangements and strategic risk management objectives. The Report does not cover the management of specific risks as such information is already provided separately to the Board in the Risk Report, May 2025 paper. 1.2 In exceptionally challenging times and with constrained resources, the council continues to apply an appropriate level of risk management to prevent or mitigate the effects of loss or harm. In doing so, we recognise that good risk management contributes to the delivery of better service and financial outcomes, business objectives, better project success rates, achievement of targets and fewer unexpected problems. 1.3 We purposefully promote a risk aware culture and strive to place risk management information at the heart of the key decisions that we make. Our risk appetite is ‘cautious.’ We take an effective approach to managing risk in a way that both addresses our significant challenges but also enables innovation. 1.4 This annual report supports the council’s code of corporate governance and seeks to provide assurance to stakeholders (internal and external) concerning the risk management arrangements in place at the council. This report is provided in the knowledge that in an independent review of the council’s risk management arrangements, during 2024/25, WTW (the auditors), concluded that “Renfrewshire Council has a well-established approach to risk management with many positive features, especially in terms of strong governance and a positive cultural attitude towards risk management at a corporate level.” 2. Risk Management Framework 2024/25: Overview 2.1 Below is an overview of the key components of the council’s risk management framework. Thereafter sections 3 to 7 of this report expand on each component and highlight specific points relevant to 2024/25 activity. (1) Infrastructure/ enablers At the heart of the council’s risk management arrangements are the strategic risk management objectives, the risk management policy and strategy and the strategic risk management development plan. Also embedded within the infrastructure are the communications systems in use for risk management information, the Intranet and the key policy boards and groups such as the Corporate Management Team and Corporate Risk Management Group that have a specific role in risk management. NOTE: looking ahead - the Framework, including Risk Matters (our combined risk management policy and strategy), is due for review in 2025/2026. The review will take account of recommendations from the recent WTW external review of the council’s risk management arrangements, and so the revised policy and strategy will be slightly delayed to May 2026 to allow the related development work to be completed. (2) Process A cyclical process for risk assessment, treatment, communication, monitoring and review of risk using a standardised risk matrix. The process and supporting matrix continue to enable a consistent approach to risk management throughout the council, set within the context of the council’s capacity and tolerance for risk, sometimes also referred to as ‘risk appetite.’ NOTE: looking ahead – the definitions and approaches associated with the terms ‘appetite’ and ‘tolerance’ will be revisited later in 2025/26 in line with WTW recommendations and anticipated guidance from ALARM later in 2025. (3) Application/ results Risk management is not viewed as an isolated function or practice but is applied to other key business processes of the council, including service planning, financial planning, performance management, procurement, project management and partnerships. Applying risk management at the right time and in the right way is key to risk management adding value to the organisation and delivering tangible results. (4) Reporting and monitoring Reporting and monitoring arrangements, including individual and group roles and responsibilities for risk management, are defined in such a way as to ensure a suitable flow of risk management information throughout the council and an appropriate level of monitoring and scrutiny relating to the effectiveness of the risk management
Page 7
2 Document Title: Risk Management Annual Report 2024/2025 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 19 May 2025 Review Dates: Not applicable arrangements in place and progress being made in relation to activity linked to strategic and corporate risk registers and service risk management plans. NOTE: looking ahead - a new form will be developed in early 2025/26 (accessible by all employees), to assist with ease of capture of risk information/ risk identification, from any area of council business and service delivery. (5) Risk management function For the risk management framework to be effective, it must be underpinned by training, guidance and ongoing development activity which raise awareness of how to implement good risk management practice across the council. This aspect of the framework informs the workplan of the corporate risk management function under the responsibility of the Director of Finance and Resources. NOTE: A recommendation of the WTW review is that the Director of Finance and Resources should “increase internal resource allocated to management of risk.” 3. Risk Management Infrastructure/ Enablers 3.1 Risk Management Policy and Strategy In November 2023 ‘Risk Matters’ the combined risk management policy and strategy was revised and approved by the Audit, Risk and Scrutiny Board1. At an interim review of Risk Matters in November 2024 (corporate risk management group), no material changes were made as it was felt that a full review would be more beneficial to take account of recommendations flowing from the external review of the council’s risk management arrangements. The review will take place in the second half of 2025/26 with a new version to be submitted to ARSB in May 2026. 3.2 Strategic Risk Management Objectives The council bases its strategic risk management objectives around the former National Risk Management Performance Assessment Model developed by ALARM2. The strategic risk management objectives remain relevant and continue to form the basis of our Strategic Risk Management Development Plan. 3.3 Strategic Risk Management Development Plan To support the ongoing implementation of ‘Risk Matters’ and the continuous improvement of risk management practice within the council, a Strategic Risk Management Development Plan (the Plan), is in place, outlining key actions that require to be completed over the life cycle of Risk Matters. The Plan is accessible to all Corporate Risk Management Group members via the Group’s MS Teams channel. Performance against the Plan is reported as follows: YEAR 1, 2024-25 Key performance figure - 100%, (12 of 12 actions) complete, against an 85% in-year target YEAR 2, 2025-26 10 of 10 actions in progress 1 Risk Matters is reviewed formally every two years by Board with an interim annual review conducted by the Corporate Risk Management Group. 2 ‘ALARM’ is a member association for risk professionals working in the public sector in the UK. The council’s Risk Manager is a Board Director of ALARM.
Page 8
3 Document Title: Risk Management Annual Report 2024/2025 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 19 May 2025 Review Dates: Not applicable 3.4 The Corporate Risk Management Group (CRMG) (1) The Group meets 6 weekly for ‘Risk Pulse’ ensuring all members are aware of developing/ emerging areas of risk and how this might impact on various risk registers. The key purpose of this meeting is to share good practice, be aware of each other’s risk context (thus promoting corporate working) and identify new and emerging risks. Risk Pulse performance has been in line with strategy/ corporate expectations. (2) The Group also meets on an ad hoc basis for ‘Risk Bite’ where meetings are arranged to ensure progress against key milestones such as ensuring risks are reviewed and reports provided timeously to Board. Risk Bite performance has been in line with strategy/ corporate expectations. (3) The final core aspect of activity is ‘Risk Dive’ where the purpose is to carry out an in-depth analysis of a specific risk to form an opinion as to whether the risk is over, under or well controlled, and take forward any improvement actions required. Risk Dive performance has not been as hoped for during 2024/25. The Group aims to undertake two deep dives per annum but due to competing priorities for the corporate risk function, only one event could be facilitated in the year. The risk explored was in relation to workforce planning, recruitment and retention. 3.5 Information and communication The council’s website continues to be the main channel through which colleagues and indeed the public can access information about our risk management arrangements. Information about the council’s insurance arrangements is available to colleagues via the intranet. The Corporate Management Group has access to further in-depth material through its extensive use of a dedicated MS Teams channel and sub channels. While risk register data is collated for reporting within the MS Teams channel, going forward there will be development undertaken to systemise this data. New in 2024/25: To improve the resilience and workload management of the risk and insurance team (total 2 FTEs), new shared mailboxes were established, thereby better channelling enquiries and requests for support. 4. Risk Management Process 4.1 The table below summarises the guidance which accompanies the risk management process. Applying this process in all aspects of business helps officers to manage their activities and pursue opportunities in a way that helps achieve objectives and prevent loss or harm. Establish the context Services consider risk in terms of context such as key themes and objectives, service priorities, operational activities or projects, longer-term or shorter-term objectives. Identify risk Services carefully define their risks in such a way as to be clear about the situation presented (opportunity, activity, service change, problem or challenge) and the consequences that may flow from it. We use risk ‘bowtie’ analysis which employees are finding very visual and helpful in understanding risk. Analyse risk Services analyse risk in terms of likelihood of occurrence and should it occur, its potential impact using the standardised risk matrix. Evaluate risk Services evaluate risk in terms of significance, being either ‘low’, ‘moderate’, ‘high’ or ‘very high’ and compare this with the council’s capacity and tolerance for risk. Treat risk Services consider a range of options when deciding on the most appropriate way to address their risks, either through measures to terminate; transfer elsewhere (such as through insurance); tolerate as it is; or treat with cost effective measures to reduce it to a level where the exposure is acceptable or tolerable for the council in keeping with its capacity and tolerance for risk. Note: in the case of opportunities, services may ‘take’ an informed risk in terms of tolerating it if an opportunity is judged to be (1) worthwhile pursuing and (2) the service is confident in its ability to achieve the benefits and justify the risk. Monitor and review risk Services are aware that once a risk assessment has been undertaken it is necessary to continue to monitor and review the risk for changes in context or the measures that are in place to control it. Communicate and consult Services are aware that it is good practice for at least two officers with relevant subject knowledge to undertake risk assessment (in consultation with other officers if necessary) with the key outcomes of
Page 9
4 Document Title: Risk Management Annual Report 2024/2025 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 19 May 2025 Review Dates: Not applicable the risk assessment process communicated to relevant persons (such as using the risk implications section on Board papers). The standardised process for risk management within the council remains fit for purpose. The steps in the process are embedded in the council’s online risk management course. 5. Risk Management Application/ Results 5.1 For risk management to truly add value for the organisation, it needs to be applied across the range of business processes in operation throughout the council and all its service departments. This section provides an outline of how this happens in practice across a range of business practices. 5.2 Risk management continues to be a key component of the council's programme and project management arrangements meaning that if risks are proactively addressed through each stage of a project, the desired outcomes are more likely to be achieved, on time and within the planned budget. 5.3 Each service continues to monitor their risks and refresh them annually, taking account of the service priorities and service improvement plans. This means that risks relating to the service priorities are proactively addressed and services are more likely to achieve their priorities and outcomes as planned. 5.4 Each year, services bring to the attention of the Director of Finance and Resources any areas of unavoidable cost pressures they are experiencing. During this process services can highlight instances where cost pressures relate to risks, and this supports effective decisions to be made in financial planning. 5.5 For risk assurance, each and every Head of Service (and direct reports to Directors), undertake self-assessment with the Business as Usual Risk Assurance Model (BaURAM © Renfrewshire Council) which was developed in house and launched in April 2023. The outputs from the model are reported to the Audit, Risk & Scrutiny Board as per the 6 monthly risk reporting requirements and separately by the Chief Auditor in relation to annual governance assurance levels. 6. Reporting and Monitoring 6.1 The governance arrangements in place during 2024/25 have continued to ensure clear lines of accountability for risk management and continue to enable a suitable flow of risk information throughout the council. The Audit, Risk & Scrutiny Board received risk progress reports on time in May and November 2024. 6.2 Each service has at least one representative on the Corporate Risk Management Group (the Group), and at least one representative from each service is always a Head of Service. The Group has overseen the 2024/25 strategic and corporate risks, monitoring progress. Services have taken ownership of their risks with processes being followed for reporting, and where necessary ‘escalation’ of significant risks to the Group. All service departments submitted their risk data on time for the 6 monthly progress reports to the Audit, Risk and Scrutiny Board as planned. 6.3 The Corporate Risk Management Group continues to operate in a way that is more dynamic in terms of monitoring risk activity across various risk registers and the Business as Usual Risk Assurance Model. 6.4 In terms of monitoring performance in risk management the council historically participated in the ALARM/ CIPFA3 former benchmarking club to assess risk maturity, and measured as level 4, where risk management was “embedded and integrated.” New in 2024/25: When undertaking their review of the council’s risk management arrangements, WTW used their own model to produce risk maturity ratings, the maximum score for a local authority like Renfrewshire being considered to be 4. The council was assessed as ‘4 – leading’ in the areas of governance and culture, as ‘3 – established’ in the areas of strategy, risk reporting and monitoring, risk analysis and evaluation, and risk 3 Chartered Institute for Public Finance and Accountancy.
Page 10
5 Document Title: Risk Management Annual Report 2024/2025 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 19 May 2025 Review Dates: Not applicable response, and as ‘2 – developing’ in the areas of risk identification and the risk control environment. For this reason the council will be introducing an additional tool/ form to enable new risks to be identified and captured from all/ any business or service delivery area. 6.5 In relation to Key Performance Indicators, as reported last year, new KPIs were agreed for implementation in 2024/25. In addition to the KPIs being agreed, targets have now been clarified, with some minor modifications to KPI descriptors required to ensure the most meaningful data was being gathered. Performance at year end was as follows. 100% Strategic RM Development Plan actions completed in year (annual, target 85%) 100% service departments undertaking horizon scanning, 6 monthly (6 monthly, target 100%) 100% 'Whose risk it anyway' delegate feedback (scoring 4 or above) (per course, target 85%) 100% services (SMTs) reviewing risk profiles regularly (>6 monthly) (annual, target 100%) 97% risk modules showing reasonable or substantial assurance (annual, target 95%) 50% risk ‘pulse’ meetings with 100% service risk rep representation (annual, target 100%) 50% deep dive exercises undertaken against target (annual, target 2 per annum) 5.4% ≥grade 9 completing the online risk module (30% in-year target) (annual, targets as follows): (NOTE: EHI services did meet the 30% target) Yr1 30%, Yr2 60%, Yr3 90%) Looking ahead, in relation to the one red KPI above, service risk reps will track grade 9 (and above) completion of the online risk management course and regularly report progress to their senior management teams in order to bring this target into line with expectations. 7. Risk Management Function/ Training and Development 7.1 The council’s Risk Management Training Strategy ensures we are clear about the council’s expectations as to the degree of risk management knowledge required across a range of roles within the council, and the risk management training and development solutions that are available and should be accessed through the council to enable competence and capacity to manage risk within those roles. 7.2 Over the course of 2024/25 the training below has been delivered, in addition to the two online courses (the introduction to risk management, and the insurance guide for procurement activities): Corporate Course (in person)* Service Specific Elected Members Other ▪ [15/03/2024] Whose Risk is it Anyway? ▪ 31/05/2024 Whose Risk is it Anyway? ▪ 27/08/2024 Whose Risk is it Anyway? ▪ 29/10/2024 Whose Risk is it Anyway? ▪ 21/11/2024 Whose Risk is it Anyway? ▪ 30/01/2025 Whose Risk is it Anyway? ▪ 11/02/2025 Whose Risk is it Anyway? (half day course)* ▪ 02/04/2024 Risk session with Children’s Services DMT ▪ 18/11/2024 Insurance and procurement for Technical Property Services ▪ 19/11/2024 Risk spotlight session for finance and procurement managers ▪ 17/02/2025 Risk session with Finance and Resources Service SMT ▪ 20/06/2024 1-2-1 elected member training ▪ 06/08/2024 1-2-1 elected member training ▪ 17/02/2025 1-2-1 elected member training ▪ 18/04/2024 Risk session with Election Team ▪ 25/06/2024 Election risk and contingency walkthrough event ▪ 15/07/2024 1-2-1 for new subject matter expert (business as usual risk assurance model) ▪ 11/11/2024 Risk session for graduate apprentice accountants ▪ 16/04/2024 1-2-1 session with a new CRMG member * Total numbers of colleagues through the ‘Whose Risk is it Anyway’ course are: ▪ Chief Execs - 06 delegates ▪ Children’s Services - 00 delegates* ▪ Environment, Housing & Infrastructure - 33 delegates ▪ Finance and Resources Services - 13 delegates ▪ Health & Social Care Partnerships - 23 delegates *Note, exploring use of in-service days.
Page 11
6 Document Title: Risk Management Annual Report 2024/2025 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 19 May 2025 Review Dates: Not applicable 7.3 Ad hoc support, advice or training requests continue to be met so far as reasonably practical. NOTE: looking ahead – following the external review of the council’s risk management arrangements undertaken in 2024/25, there has been recognition that further resource is required within the corporate risk function to ensure resilience and capacity. 7.4 To continue to provide evidenced based training, development and advice for the council, the council’s Risk Manager maintains continued professional development in her field and is qualified to Masters Level (MSc in Risk Management awarded by Glasgow Caledonian University). 7.5 Through membership of some groups and organisations that include ALARM, the Risk Manager keeps abreast of risk management developments and best practice in other public-sector organisations and local authority areas. The Risk Manager now sits on the ALARM Board and is presently serving a two year term as ALARM President. This role means greater development opportunities that in turn serve the council well. 7.6 Through the council’s contracts with Insurers and Insurance Brokers, the Risk and Insurance Team keep up to date with developments in the insurance sector to ensure that the council’s insurance interests and liabilities are protected so far as possible. 8. Conclusion 8.1 This Report has provided an overview of risk management arrangements and activity relating to 2024/25 in regard to the council’s corporate-led risk management approach. It is intended that the report provides assurance to the Board.