Risk update Report ARSB Sept_2023_FINAL 1
Renfrewshire Council · 26 September 2023
Back to Audit, Risk and Scrutiny Board — 26 September 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 26 September 2023 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: Risk Update Report ___________________________________________________________________ 1. Summary 1.1 Each year the Board considers and approves the Council’s risks. 1.2 The Board would usually receive risk reports in May and November each year. The purpose of this risk paper is to update the Board on actions outlined in the response to recommendations of the Dargavel Primary School independent review as agreed by Council in June 2023. 1.3 Appendix 1 details a new risk that is being added to the corporate risk register to ensure that the independent review recommendation in relation to risk management and related actions are monitored. ________________________________________________________________________________ 2. Recommendations 2.1 It is recommended that the Board notes the content of the report. _________________________________________________________ 3. Background 3.1 The recent external review into Dargavel included a number of recommendations for the Council to consider. The first 4 recommendations related to the delivery of the education solution for Dargavel specifically and the other recommendations focused on organisational learning, with two of those recommendations focused on corporate working and risk management. 3.2 Recommendation 6 of the External Review stated: “The Council needs to review how it both identifies risk and manages it.”
Page 2
3.4 Concerning recommendation 6, the Chief Executive noted that the handling of risk in relation to the Dargavel Village development is not representative of the council’s current practice in managing large scale projects or those which potentially involve commercial risk. There are well-established risk management approaches deployed and supported by project and risk management specialists as well as multi-disciplinary teams, and external support and expertise is utilised where this is appropriate. These approaches are well-established in centrally managed projects and programmes. 3.4 As previously reported to the Board, the council has robust arrangements in place for managing corporate, strategic, and business-as-usual risks, and there is a clear governance framework in place with 6-monthly reporting to the Audit, Risk and Scrutiny Board, having delegated authority for risk management matters. However, in order to make best use of the learning from the Review, officers are progressing a number of actions that would further strengthen our approach. The key actions being (or indeed already) progressed include: • a belt and braces review of risk profiles across all service departments to ensure visibility of all risks and confirmation of where certain risks are being monitored if outwith the standard Risk Reports to the Audit, Risk and Scrutiny Board (i.e., Health and Safety Planning Groups, Service Improvement Plans etc) • a review of the ‘service risk rep’ roles in each service department to ensure the reps who sit on the Corporate Risk Management Group are sufficiently involved in risk matters within the service, to feed this into the Corporate Risk Management Group and that they also have authority within the service to provide challenge as a ‘critical friend’ • exploring more sophisticated risk modelling for major capital projects • delivery of a project risk management workshop specific to the planned new primary school in Dargavel • delivery of project risk management training with all PMU colleagues (in a train the trainer format) so colleagues are delivering this as part of project kick-offs to support a more risk focussed culture in the organisation • undertaking a ‘healthcheck’ of project management arrangements across the council to ensure governance, management, reporting and risk management is appropriate to the scale of the project • an update to the risk management course on iLearn and consideration of whether it should be a mandatory course (on a one-off basis at least) • embedding risk management training into the new leadership development programme that is currently under development, particularly in relation to commercial risk • reviewing governance documents to ensure delegations in relation to liability caps are clear and unambiguous 3.5 All of the above activity is embedded in the new risk shown in Appendix 1, along with details of the officers taking forward the action and the planned timescales for delivery of the actions. __________________________________________________________________
Page 3
Implications of the Report 1. Financial Recurring costs associated with the measures in place for the risk are considered proportionate to the level of risk, and new planned actions are also considered to be cost effective. The financial requirements to support the risk should be met within the budget of each relevant risk owner, nevertheless, any unplanned and unbudgeted cost pressures that arise in relation to any of the risks identified will be subject to review in consultation with the Director of Finance and Resources. 2. HR & Organisational Development – not relevant to report recommendations 3. Community/Council Planning – effective risk management supports the delivery of all community/ council plan outcomes 4. Legal – not relevant to report recommendations 5. Property/Assets – not relevant to report recommendations 6. Information Technology – not relevant to report recommendations 7. Equality & Human Rights – not relevant to report recommendations 8. Health & Safety – not relevant to report recommendations 9. Procurement – not relevant to report recommendations 10. Risk – as per the subject matter of this report 11. Privacy Impact – not relevant to report recommendations 12. Cosla Policy Position – not relevant to report recommendations 13. Climate Risk – not relevant to report recommendations _________________________________________________________ Author: Karen Locke, Risk Manager Tel: 07506 957 037, Email: Karen.Locke@renfrewshire.gov.uk
Page 4
Appendix 1: New corporate risk: Organisational learning from Dargavel Review Context Risk Statement Owned by Current Controls Likelihood Impact Evaluation CODE TBC Organisational learning from Dargavel Review The council must progress the improvements as a matter of urgency or there is a risk that without sufficient learning, similar errors to those made in the past could occur again, with further financial implications and significant reputational damage for the council. CMT (1) Corporate leads identified to ensure recommendations are taken forward. (2) Board reporting to ensure scrutiny of progress 02 05 10 High The recent External Review into Dargavel, and the council’s response, highlighted several areas for improvement. The first 4 recommendations related to the delivery of the solution for Dargavel specifically and the others were as follows: ▪ Recommendation 5 - Corporate working and organisational culture ▪ Recommendation 6 - Risk management ▪ Recommendation 7 - Role of members ▪ Recommendation 8 - Public confidence Action Codes Actions Assigned To Date Status Response to Rec 6 “It is proposed to undertake a programme of review of current risk management processes supporting major projects and deliver a programme of development across the Council’s senior officer cohort in relation to identifying, managing and mitigating project risk, with a particular emphasis on commercial risk when contracting with external third parties as part of major projects and procurement exercises. It is expected that this programme of review and training will be progressed over the course of 2023.” Escalation of programme/ project management (governance) risk from risk assurance model to corporate risk register until improved governance explored and implemented for projects Risk Manager 31-Aug-2023 Create two new risks on the corporate risk register. One for delivery of the Dargavel 2 solution and one for our organisational learning from the Dargavel investigation Risk Manager 31-Aug-2023 Deliver a project risk management workshop specific to the new primary school at Dargavel Risk Manager 31-Aug-2023 Share project risk management training with all PMU colleagues (train the trainer) so they are delivering this as part of project kick-offs to support a more risk focussed culture in the organisation Risk Manager 30-Sep-2023 Explore more sophisticated risk modelling for major capital projects CMT 31-Oct-2023 All services to undertake a belt and braces review of risk profiles to ensure visibility of risks and confirmation of where certain risks are being monitored if outwith the standard Risk Report (i.e., Health and Safety Planning Groups, Service Improvement Plans) All Directors, individually 31-Oct-2023 All service Directors to review ‘service risk rep’ roles to ensure their reps (on the Corporate Risk Management Group) are sufficiently involved in risk matters within the service, to feed this into the Corporate Risk All Directors, individually 31-Oct-2023
Page 5
Management Group and that they also have authority within the service to provide challenge as a ‘critical friend’ Undertake a healthcheck of project management arrangements across the council to ensure governance, management, reporting and risk management is appropriate to the scale of the project PMU Manager 30 Nov 2023 Revisit and update risk management course on iLearn and explore if it should be mandatory (on a one-off basis) Risk Manager 30-Nov-2023 Linked to recommendation 5, arrange a risk management development day/ half day for CMT and Heads of Service: • Project risk management (and risk simulation exercise) • Risk horizon scanning and sustainability (the Global Risk Report) • Liability caps and their implications PMU Manager, Risk Manager, Managing Solicitor (Projects) 31-Dec-2023 Review of governance documents to ensure it is explicit re delegations for liability caps Head of Governance 31-Dec-2023 Review of Standing Orders for Contracts in respect of liability caps Head of Finance and Procurement 31-Dec-2023