Risk Management Annual Report 2022-2023_FINAL
Renfrewshire Council · 22 May 2023
Back to Audit, Risk and Scrutiny Board — 22 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Page 2 of 3 ___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 22 May 2023 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: Risk Management Annual Report 2022/2023 ___________________________________________________________________ 1. Summary 1.1 1.2 1.3 This paper presents the Risk Management Annual Report for 2022/2023 (Appendix 1). The Report describes the corporate risk management activity that has taken place during 2022/2023 in relation to the council’s risk management arrangements and strategic risk management objectives. It is not the purpose of this paper to report on the management of specific risks as such information is already provided separately to the Board in the Risk Report, May 2023 paper. In exceptionally challenging times and with diminishing resources, the council continues to apply an appropriate level of risk management to prevent or mitigate the effects of loss or harm. In doing so, we recognise that good risk management contributes to the delivery of better financial outcomes, business objectives, better project success rates, achievement of targets and fewer unexpected problems. We purposefully promote an environment that is risk ‘aware’ rather than risk ‘averse’ and strive to place risk management information at the heart of the key decisions that we make. This means that we can take an effective approach to managing risk in a way that both addresses our significant challenges and enables innovation. ___________________________________________________________________ 2. Recommendations 2.1 It is recommended that the Board considers the content of the Annual Report and notes the significant contribution that it makes with regards to the council’s corporate governance arrangements. ___________________________________________________________________
Page 2
Page 3 of 3 3. Background 3.1 In keeping with the ‘Scheme of Delegated Functions’ a Risk Management Annual Report is provided to the Audit, Risk and Scrutiny Board each year for consideration. The report supports the council’s code of corporate governance and seeks to provide assurance to stakeholders (internal and external) concerning the risk management arrangements applied during 2022/2023. _________________________________________________________________ __ Implications of the report 1. Financial – not relevant to report recommendations 2. HR & Organisational Development – not relevant to report recommendations 3. Community/Council Planning – effective risk management supports the delivery of all community/ council plan outcomes 4. Legal – not relevant to report recommendations 5. Property/Assets – not relevant to report recommendations 6. Information Technology – not relevant to report recommendations 7. Equality & Human Rights – not relevant to report recommendations 8. Health & Safety – not relevant to report recommendations 9. Procurement – not relevant to report recommendations 10. Risk – as per the subject matter of this report 11. Privacy Impact – not relevant to report recommendations 12. Cosla Policy Position – not relevant to report recommendations 13. Climate Risk – not relevant to report recommendations ___________________________________________________________________ List of Background Papers (a) Non applicable – reports provided on a year-by-year basis ___________________________________________________________________ Author: Karen Locke Risk Manager 07506 957 037 Karen.Locke@renfrewshire.gov.uk
Page 3
Document Title: Risk Management Annual Report 2022/2023 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 22 May 2023 Review Dates: Not applicable Appendix 1 Risk Management Annual Report 2022 - 2023
Page 4
Document Title: Risk Management Annual Report 2022/2023 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 22 May 2023 Review Dates: Not applicable CONTENT 1. Introduction ........................................................................................................................................... 1 2. Risk Management Framework 2022/23: Overview ............................................................................... 1 3. Risk Management Infrastructure/ Enablers ........................................................................................... 2 4. Risk Management Process ..................................................................................................................... 3 5. Risk Management Application/ Results ................................................................................................. 4 6. Reporting and Monitoring ..................................................................................................................... 4 7. Risk Management Function/ Training and Development ...................................................................... 5 8. Conclusion ............................................................................................................................................. 5
Page 5
1 Document Title: Risk Management Annual Report 2022/2023 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 22 May 2023 Review Dates: Not applicable 1. Introduction 1.1 The Risk Management Annual Report is provided to the Audit, Risk and Scrutiny Board each year in keeping with its delegated function of considering the corporate risk management annual report. The Report describes the corporate- led risk management activity that has taken place during 2022/23 in relation to the council’s risk management arrangements and strategic risk management objectives. The Report does not cover the management of specific risks as such information is already provided separately to the Board in the Risk Report, April 2023 paper. 1.2 In exceptionally challenging times and with diminishing resources, the council continues to apply an appropriate level of risk management to prevent or mitigate the effects of loss or harm. In doing so, we recognise that good risk management contributes to the delivery of better financial outcomes, business objectives, better project success rates, achievement of targets and fewer unexpected problems. 1.3 We purposefully promote an environment that is risk ‘aware’ rather than risk ‘averse’ and strive to place risk management information at the heart of the key decisions that we make. This means that we can take an effective approach to managing risk in a way that both addresses our significant challenges and enables innovation. 1.4 This annual report supports the council’s corporate governance arrangements and seeks to provide assurance to stakeholders (internal and external) concerning the organisational risk management arrangements applied during 2022/23. 2. Risk Management Framework 2022/23: Overview 2.1 Below is an overview of the key components of the council’s risk management framework. Thereafter sections 3 to 7 of this report expand on each component and highlight specific points relevant to 2022/23 developments. (1) Infrastructure/ enablers At the heart of the council’s risk management arrangements are the strategic risk management objectives, the risk management policy and strategy and the strategic risk management development plan. Also embedded within the infrastructure are the communications systems in use for risk management information, the Intranet and the key policy boards and groups such as the Corporate Management Team and Corporate Risk Management Group that have a specific role in risk management. (2) Process A cyclical process for risk assessment, treatment, communication, monitoring and review of risk using a standardised risk matrix. The process and supporting matrix continue to enable a consistent approach to risk management throughout the council, set within the context of the council’s capacity and tolerance for risk, sometimes also referred to as ‘risk appetite.’ (3) Application/ results Risk management is not viewed as an isolated function or practice but is applied to other key business processes of the council, including service planning, financial planning, performance management, procurement, project management and partnerships. Applying risk management at the right time and in the right way is key to risk management adding value to the organisation and delivering tangible results. (4) Reporting and monitoring Reporting and monitoring arrangements, including individual and group roles and responsibilities for risk management, are defined in such a way as to ensure a suitable flow of risk management information throughout the council and an appropriate level of monitoring and scrutiny relating to the effectiveness of the risk management arrangements in place and progress being made in relation to activity linked to strategic and corporate risk registers and service risk management plans. (5) Risk management function For the risk management framework to be effective, it must be underpinned by training, guidance and ongoing development activity which raise awareness of how to implement good risk management practice across the council. This aspect of the framework informs the workplan of the corporate risk management function under the responsibility of the Director of Finance and Resources.
Page 6
2 Document Title: Risk Management Annual Report 2022/2023 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 22 May 2023 Review Dates: Not applicable 3. Risk Management Infrastructure/ Enablers 3.1 Risk Management Policy and Strategy In March 2021 ‘Risk Matters – the next level,’ the combined risk management policy and strategy was revised and approved by the Audit, Risk and Scrutiny Board1. There have been no changes to the policy or strategy over the past year as our corporate risk management activity has been focused on the development work required to implement and embed the various changes agreed by the Board when approving Risk Matters in 2021. Risk Matters is due to come back to Board for formal approval again in November 2023. Strategic Risk Management Objectives The council bases its strategic risk management objectives around the former National Risk Management Performance Assessment Model developed by ALARM2. The strategic risk management objectives remain relevant and continue to form the basis of our Strategic Risk Management Development Plan. 3.2 Strategic Risk Management Development Plan To support the implementation of “Risk Matters – the next level” and the ongoing development of risk management practice within the council, a Strategic Risk Management Development Plan (the Plan), is in place, outlining key actions that require to be completed over the life cycle of Risk Matters. The Plan is accessible to all Corporate Risk Management Group members via the Group’s MS Teams channel. As reported to Board in May 2021, the creation of the 2021 Plan was paused for several reasons including, but not limited to, the significant tender exercise in 2021 to put in place all the council’s insurance policies. A new Plan was therefore to be created for 2022/2024. The Group is pleased to report to Board on the progress of the two-year Plan as follows: YEAR 1, 2022-23 Key performance figure (year-end) - 100%, (30 of 30 actions) for 2022/23 complete (against an 85% in-year target) YEARS 1 and 2 combined, 2022-24 Key performance figure (2-yr end) - 79%, 30 of 38 actions for 2022/24 complete (against an 85% full plan target) Year 2, 2023/24, there are no current concerns regarding capacity to deliver on the planned actions. 1 Risk Matters is reviewed formally every two years by Board with an interim annual review conducted by the Corporate Risk Management Group. 2 ‘ALARM’ is the public sector risk management association. The council’s Risk Manager is a Board Director of ALARM.
Page 7
3 Document Title: Risk Management Annual Report 2022/2023 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 22 May 2023 Review Dates: Not applicable 3.3 The Corporate Risk Management Group The revised Risk Matters approved by Board in March 2021 brought in a new and refreshed role for the Corporate Risk Management Group from April 2021 onwards. Making better use of technologies available, the Group’s activities are now not so much driven by meeting schedules but rather, use MS Teams ‘channels’ more effectively, enabling more dynamic conversations and activities in relation to risk management. Meetings do take place to check that risk owners are updating their risks and key milestones are met, such as reporting to Board, and where joint discussion and debate is required on corporate initiatives or on activities to support the Strategic Risk Management Development Plan. New in 2022/23: The Corporate Risk Management Group has undertaken its first ‘control deep dive.’ Control deep dive is a valuable exercise which involves detailed investigation of specific risk controls known to be in place. The purpose of the deep dive exercise is to form a view on whether the risk is under controlled, well controlled, or over controlled. The exercise undertaken in March focused on the council’s cyber security arrangements (both technical and non-technical controls). The outputs have been finalised with a report going to the Corporate Management Team in April 2023 with appropriate recommendations. 3.4 The Intranet The intranet continues to be a key tool for communicating and providing risk management information and guidance to all staff with access to it. The Intranet risk management pages provide access to ‘Risk Matters’ and a range of supporting guidance documents and templates and contact details for the risk management and insurance service. 4. Risk Management Process 4.1 The standardised process for risk management within the council remains fit for purpose. The table below summarises the guidance which accompanies the process. Applying this process in all aspects of business helps officers to manage their activities and pursue opportunities in a way that helps achieve objectives and prevent loss or harm. Establish the context Services consider risk in terms of context such as key themes and objectives, service priorities, operational activities or projects, longer-term or shorter-term objectives. Identify risk Services carefully define their risks in such a way as to be clear about the situation presented (opportunity, activity, service change, problem or challenge) and the consequences that may flow from it. We use risk ‘bowtie’ analysis which employees are finding very visual and helpful in understanding risk. Analyse risk Services analyse risk in terms of likelihood of occurrence and should it occur, its potential impact using the standardised risk matrix. Evaluate risk Services evaluate risk in terms of significance, being either ‘low’, ‘moderate’, ‘high’ or ‘very high’ and compare this with the council’s capacity and tolerance for risk. Treat risk Services consider a range of options when deciding on the most appropriate way to address their risks, either through measures to terminate; transfer elsewhere (such as through insurance); tolerate as it is; or, treat with cost effective measures to reduce it to a level where the exposure is acceptable or tolerable for the council in keeping with its capacity and tolerance for risk. Note: in the case of opportunities, services may ‘take’ an informed risk in terms of tolerating it if an opportunity is judged to be (1) worthwhile pursuing and (2) the service is confident in its ability to achieve the benefits and justify the risk. Monitor and review risk Services are aware that once a risk assessment has been undertaken it is necessary to continue to monitor and review the risk for changes in context or the measures that are in place to control it. Communicate and consult Services are aware that it is good practice for at least two officers with relevant subject knowledge to undertake risk assessment (in consultation with other officers if necessary) with the key outcomes of the risk assessment process communicated to relevant persons (such as using the risk implications section on Board papers). 4.2 A major achievement in 2022/23 relates to the new risk assurance model which saw ‘business as usual’ risks lifted out of the risk management process above, with an alternative focus on risk assurance developed. (More on that at 5.5)
Page 8
4 Document Title: Risk Management Annual Report 2022/2023 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 22 May 2023 Review Dates: Not applicable 5. Risk Management Application/ Results 5.1 For risk management to truly add value for the organisation, it needs to be applied across the range of business processes in operation throughout the council and all its service departments. This section provides an outline of how this happens in practice across a range of business practices. 5.2 Risk management continued to be a key component of the council's programme and project management arrangements meaning that if risks are proactively addressed through each stage of a project, the outcomes are more likely to be achieved on time and within the planned budget. 5.3 Each service continues to monitor their risks and refresh them annually, taking account of the service priorities and service improvement plans. This means that risks relating to the service priorities are proactively addressed and services are more likely to achieve their priorities and outcomes as planned. 5.4 Each year, services bring to the attention of the Director of Finance and Resources any areas of unavoidable cost pressures they are experiencing. During this process services can highlight instances where cost pressures relate to risks, and this supports effective decisions to be made in financial planning. New in 2022/23: The Corporate Risk Management Group (in partnership with ICT and Business Analysis colleagues and subject matter experts for ‘business as usual’ risks), completed the development work to support better assurance around how these risks are handled. Short life working groups developed practical assurance question sets for each area of risk, and the new model, now live, requires all Heads of Services to complete all 12 modules over the course of 2023/24. This means that audit and risk colleagues and subject matter experts will be able to have a corporate view on the levels of assurance for each aspect of risk and this will be reported to Board in due course. 6. Reporting and Monitoring 6.1 The governance arrangements in place during 2022/23 have continued to ensure clear lines of accountability for risk management and continue to enable a suitable flow of risk information throughout the council. The Audit, Risk & Scrutiny Board previously received a progress report on risk in November 2022. 6.2 Each service has a representative on the Corporate Risk Management Group (the Group). The Group has overseen the 2022/23 strategic and corporate risks, monitoring progress. Services have taken ownership of their risks with processes being followed for reporting, and where necessary ‘escalation’ of significant risks to the Group. All service departments submitted their risk data on time for the progress reports to the Audit, Risk and Scrutiny Board as planned. 6.3 The Corporate Risk Management Group has now updated how and when it meets and monitors risk in a way that is more dynamic. ▪ Risk pulse: 6-weekly MS Teams calls, touching base with each other and reporting in any important matters of mutual interest and flagging any perceived emerging risk. ▪ Risk dives: twice yearly 'in person' half days (as per control deep dives described earlier at 3.3). ▪ Risk bites: meetings arranged on an ad hoc basis to check progress on aspects of risk management development work. 6.4 In terms of monitoring performance in risk management the council historically participated in the ALARM/ CIPFA3 benchmarking club, using ALARM’s National Risk Management Performance Assessment Model. Although the benchmarking club no longer exists the risk maturity model attached to it still does, describing maturity as: ▪ Level 1 Awareness ▪ Level 2 Happening ▪ Level 3 Working ▪ Level 4 Embedded and integrated ▪ Level 5 Driving The council aims for and is performing at level 4. 6.5 In relation to Key Performance Indicators for risk management, the set previously in place have now been set aside on the basis that they have been superseded by the development work of the previous 2 years. New indicators will require to be established towards the end of 2023/24 for implementation in 2024/25. 3 Chartered Institute for Public Finance and Accountancy.
Page 9
5 Document Title: Risk Management Annual Report 2022/2023 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 22 May 2023 Review Dates: Not applicable 7. Risk Management Function/ Training and Development 7.1 The council’s Risk Management Training Strategy ensures we are clear about the council’s expectations as to the degree of risk management knowledge required across a range of roles within the council, and the risk management training and development solutions that are available and should be accessed through the council to enable competence and capacity to manage risk within those roles. Post covid, more training is delivered now online, either via narrated slides or iLearn, which anyone can access at a time convenient to their own situation/ workloads, or even bespoke sessions developed for colleagues interested in a specific aspect of risk. 7.2 Over the course of 2022/23 the following bespoke presentations, workshops or training-related activities were delivered: ▪ Risk and contingency event for the local government election ▪ Health and social care integration: risk practitioner perspective ▪ Risk session for health and social care partnership ‘leadership network’ ▪ Contract risk and insurance training for Scotland Excel ▪ Risk management workshop for Renfrewshire Valuation Joint Board ▪ Risk management training for OneRen directors x 2 sessions ▪ Risk management training for council employees doing their university business management courses x 2 sessions ▪ Risk management training for Audit, Risk and Scrutiny Board members ▪ Risk ‘deep dive’ method development and facilitation 7.3 Ad hoc support, advice or training requests continue to be met so far as reasonably practical. 7.4 To continue to provide evidenced based training, development and advice for the council, the council’s Risk Manager maintains continued professional development in her field and is qualified to Masters Level (MSc in Risk Management awarded by Glasgow Caledonian University). 7.5 Through membership of a number of groups that include ALARM (the Public Risk Management Association), and the ALARM Scotland Group, the Risk Manager keeps abreast of risk management developments and best practice in other public-sector organisations and local authority areas. The Risk Manager now sits on the ALARM Board and is presently serving as President-Elect (shadowing the President for 2 years). This role means greater development opportunities that in turn serve the council well. 7.6 Through the council’s contracts with Insurers and Insurance Brokers, the Risk and Insurance Team keep up to date with developments in the insurance sector in order to ensure that the council’s insurance interests and liabilities are protected so far as possible. 8. Conclusion 8.1 This Report has provided an overview of risk management arrangements and activity relating to 2022/23 in regard to the council’s corporate-led risk management approach. It is intended that the report provides assurance to the Board.