Risk Matters - 2023
Renfrewshire Council · 6 November 2023
Back to Audit, Risk and Scrutiny Board — 6 November 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 06 November 2023 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: “Risk Matters,” the combined risk policy and strategy ___________________________________________________________________ 1. Summary 1.1 Risk Matters is formally reviewed with approval sought from the Board, every two years, and an interim review conducted by the Corporate Risk Management Group on behalf of the Corporate Management Team. 1.2 At this time there are no material changes proposed to Risk Matters following review by the Corporate Risk Management Group in October 2022; only one minor amendment has been made to reflect a change in terminology for the council’s risk appetite as being risk cautious (neither risk averse, nor risk eager). Previously, the appetite had been defined as “risk aware.” 1.3 “Risk Matters” is presented in full in Appendix 1 version 15.0 for the Board to consider for approval. ________________________________________________________________________________ 2. Recommendations 2.1 It is recommended that the Board approves “Risk Matters” version 15.0 in keeping with the Board’s delegated authority for the council’s risk management arrangements. _________________________________________________________ 3. Background 3.1 The council’s risk management arrangements are well established and robust. 3.2 Risk Matters, the combined risk management policy and strategy, continues to reflect good practice, is aligned to recognised standards and takes account of learning through benchmarking with other public sector organisations. ___________________________________________________________________
Page 2
Implications of the Report 1. Financial - There are no specific financial risks associated with the provision of this paper. A key benefit of effective risk management is better use and prioritisation of the council’s resources 2. HR & Organisational Development - key benefits of effective risk management include high levels of employee morale and productivity and further enhancement of the council’s good reputation both as an employer and as a public service provider 3. Community/Council Planning – revised strategy supports strategic and corporate risks being aligned to community/ council plan outcomes 4. Legal - key benefit of effective risk management is a higher level of service user experience/ satisfaction with a consequent reduction in adverse incidents, claims and/ or litigation 5. Property/Assets - key benefit of effective risk management is better use and prioritisation of the council’s resources/ assets 6. Information Technology - key benefit of effective risk management is better use and protection of the council’s ICT resources/ assets 7. Equality & Human Rights - not relevant to report recommendations 8. Health & Safety - key benefit of effective risk management is a reduction in adverse health and safety incidents 9. Procurement - risk management principles are built into the council’s procurement processes to ensure supply chain management and contract risks are addressed 10. Risk – as per the subject matter of this report 11. Privacy Impact – not relevant to report recommendations 12. Cosla Policy Position – not relevant to report recommendations 13. Climate Risk – risk management principles are key to effective climate risk management _________________________________________________________ Author: Karen Locke, Risk Manager 23/10/2023 Tel: 07506 957 037, Email: Karen.Locke@renfrewshire.gov.uk
Page 3
Renfrewshire Council Risk Matters November 2023, Risk Policy & Strategy, v.15.0
Page 4
Risk Management Policy Signed: Alastair MacArthur, Director of Finance and Resources, October 2023 Our risks We align with industry standards for our risk management process. We will be open about our risks and risk appetite; knowing when risks are acceptable to take or tolerate, or not. We will handle risk in a way that adds most value to the business. The Council promotes a culture where employees are encouraged to develop new initiatives, improve performance and achieve goals safely, effectively and efficiently by appropriate application of good risk management practice. In doing so we aim to protect vulnerable people, deliver high quality services for all service users, achieve high standards of performance, make the most of opportunity, and provide a safe environment for those we employ, contract or partner with in providing a wide range of services. Our approach We will encourage our people to manage risk well and will equip them with the skills to do so. We will be risk cautious (neither risk averse, nor risk eager). We will embed good risk management in our business processes. Our principles We will use risk information to make fair judgments and good decisions. We will learn from the past to build a better and more resilient future. We will work with our partners for the benefit of our citizens. Our vision Good risk management practice will be embraced as an enabler of success, whether in pursuing opportunity and innovation, or, managing imminent, shorter term or longer term challenges. 2
Page 5
Risk Management Strategy Our strategy is integral to our risk management framework. Governance & Reporting – structures, roles and responsibilities for managing/ reporting on risks and the effectiveness of the framework and risk objectives. Enablers - our fundamental building blocks for success; what we need to make risk management ‘happen.’ Process - a standardised way to identify, assess and evaluate risks consistently. Application – areas of business activity where applying good risk management should add value and deliver results. Risk Service – a dedicated resource for promoting and supporting the risk management framework. Application/ Results Policies Planning Performance Budgeting Project Mgt. Enablers Objectives Guidance People Training Development eSystems Risk Management Process ...linked to our risk appetite Governance: Leadership, Reporting and Accountability Board, Groups and Individuals Supported by the Risk (and Insurance) Service Risk Management Policy & Strategy 3
Page 6
Governance Roles and Responsibilities -Groups Renfrewshire Council’s Scheme of Delegated Functions specify matters which are the delegated responsibility of Boards and the Chief Executive; including risk management. The diagram here shows how risk information flows throughout the council. Pages 5 to 8 set out the specifics of how this works and the various responsibilities. Council (Elected members) Audit, Risk & Scrutiny Board (Elected members) Corporate Management Team (Chief Exec and Directors) Corporate Risk Management Group (Risk reps from each service and risk specialists) Individuals Frontline teams/ groups/ services Subject matter experts Project management teams Senior Management Teams (Directors with their Heads of Service/ Senior Managers) 4
Page 7
All policy boards consider recommendations in relation to any specific risks brought to the board as a matter of business as usual (through the risk implications section of Board Papers). Policy boards have a further responsibility to facilitate the sharing of learning across the council, from good practice or any events or near misses that identify trends and potential risk. Council and Policy Boards The Audit, Risk and Scrutiny Board (ARS), has authority to 1. approve the risk management policy and strategy. 2. consider the effectiveness of the risk management arrangements through consideration of the annual risk management report. 3. oversee the Council’s risks and associated actions through consideration of six monthly risk reports. The Council holds overall accountability for ensuring we have a suitable risk management framework in place so that significant risks are adequately identified and controlled. The execution of this risk related duty is delegated to the Audit, Risk & Scrutiny Board. 5
Page 8
Corporate Management Team In respect of the Risk Management Framework, the Corporate Management Team promotes a risk aware culture and encourages good risk management practice across all services and activities. The CMT ensures risk information and data is used to guide major decisions in areas such as policy development, service planning, performance monitoring, budget planning, investment programmes, change programmes, projects and partnerships. The CMT ensures that a member of the management team oversees the risk management framework on behalf of the Chief Executive, and ensures the remit of the risk service/ risk manager is clear. For reporting of risk information, the CMT ensures arrangements are clear and are implemented across the organisation. The CMT ensures that key performance measures are in place to check that risk management is in line with the risk management policy and strategy and ensures that risk management arrangements are reviewed at a minimum of every two years so that it remains fit for purpose and reflects best practice. In respect of managing risk as part of its normal business reporting arrangements the CMT will regularly receive updates on risks relating to the council and community plan objectives and strategic recovery plans (economic, financial and social), ensuring that significant risks that could impact on key objectives or service delivery responsibilities are identified and responded to appropriately. On an annual basis the CMT will additionally review and agree the organisation’s risk registers to be submitted to the Audit, Risk & Scrutiny Board for approval, ensuring risk owners are clearly identified. The CMT will provide support to the Corporate Risk Management Group for undertaking deep dives into various risk control measures. The CMT maintain a clear understanding of the council’s risk profile and how it relates to the council’s appetite for risk. The CMT has a vital role in ongoing horizon scanning for potential new risks (opportunities or threats), yet encouraging innovation through appropriate and informed risk management. 6
Page 9
In respect of the Risk Management Framework, the CRMG leads on implementing the Strategic Risk Management Development Plan (SRMDP) that supports delivery of the risk management policy and strategy. The Group develops and monitors key risk management performance indicators and prepares the risk management annual report on the effectiveness of the council’s risk management framework in order to provide assurance to the ARS Board. The Group leads risk management initiatives across all services and facilitates sharing of good risk management between services. Risk ‘specialists’ who sit on the Group (the Risk Management Alliance) take forward specific initiatives related to the Group’s remit and provide related regular updates. Corporate Risk Management Group (CRMG) In respect of managing risk, the Group co-ordinates the provision of 6- monthly risk reports; a report at the start of the year to the CMT for agreement and onwards submission to the Audit, Risk & Scrutiny Board for approval and a mid-year update to the Board. The Group ensures that suitable arrangements are in place for the management of ‘business as usual’ risks across the organisation and undertakes deep dives on specific risks so that best value is delivered in managing risk, and that risks are not materially over or under controlled. 7
Page 10
Risk Management Alliance (RMA) The RMA has a small number of employees in risk-related roles (audit, risk management & insurance, health & safety, civil contingencies), who work together as subject experts and subgroup of the Corporate Risk Management Group. An extended RMA with colleagues responsible for data, property and motor matters also meets as required. The RMA provides a central resource of expertise to the wider council, working closely together on various matters either directly or through/at the request of other council services. It is through members of the RMA that services can often access other internal or external sources of expertise such Police, Insurers and/ or Insurance brokers/ advisors. Specialists, Local Teams (Services, Groups or Projects) Service management teams regularly review their service risk profiles ensuring visibility of these in the 6-monthly risk reports submitted to the Audit, Risk & Scrutiny Board. Managers also highlight risks in the risk implications section of papers going to Boards. Other teams, groups or specialists who consider risk matters in one way or another (i.e. health and safety planning groups, the information management and governance group, or project teams), will be familiar with the council’s risk management framework and ensure they access training and other services available to them through the council’s Risk Manager or RMA. Such groups should also keep their service risk reps informed of any developing or emerging risks so that these can be captured in service risk registers where appropriate. 8
Page 11
Governance Roles and Responsibilities -Individuals Individuals – the bubbles to the right show the named individuals who have specific roles in risk management – over and above the responsibilities that all employees have. Pages 10 to 14 set out the specifics in more detail. Chief Executive Director of Finance & Resources Risk Manager All Directors Chief Auditor All Heads of Service Head of Child Care & Criminal Justice Service Risk Reps Elected Members 9
Page 12
Director of Finance & Resources The Director is directly accountable to the Chief Executive and is the CMT member responsible for overseeing the council’s risk management framework and remit of the risk management function. The Director is responsible for leadership and co-ordination of the risk management agenda, for undertaking the role of ‘Senior Information Risk Owner’ and for ensuring any significant risk issues requiring attention are brought before the CMT. The Director of Finance and Resources is supported in their role by the Chief Auditor and the Risk Manager. Elected Members A significant aspect of an elected member’s role is in making decisions for the council and the people of Renfrewshire. In considering any recommendations from officers relating to new policies/ proposals, members ensure they are aware of the risks and benefits involved prior to making their decisions. The ‘risk implications’ section on board papers will enable appropriate risk information to be provided and reviewed. Chief Executive The Chief Executive is accountable for the council’s risk management framework, ensuring suitable and effective arrangements are in place to manage the council’s risks. The Chief Executive is supported in this role by the Director of Finance and Resources. 10
Page 13
Risk Manager This role is an enabling role, encouraging officers to practice sound risk management. The role provides advice and guidance to services in implementing the council’s risk policy and strategy and supports risk management in high profile areas of activity within the organisation. The Risk Manager provides training and development opportunities for members, employees and partners through a variety of methods, such as linked to elected member training, management development programmes and projects. As chair of the Corporate Risk Management Group and Risk Management Alliance, the Risk Manager ensures suitable arrangements are in place so that the CRMG can deliver best value in its activities for the council and make timely submissions to Board in relation to strategic, corporate and service risks and the risk management annual report. Making sure insurable risk across the council is appropriately covered also falls within the remit of the Risk Manager Chief Auditor The Chief Auditor supports the strategic direction of risk management in the council, overseeing the work of the risk management service which includes delivering risk management guidance, training and development and risk software for recording organisational risks. The Chief Auditor ensures that the strategic audit plan considers the council’s key risks as well as key areas of organisational change for which risk is inherent, and ensures that the outputs of internal audit work similarly inform the strategic, corporate and service risks in terms of any required improvements identified. 11
Page 14
All Directors Service directors and their senior management teams implement local arrangements in support of the risk policy and strategy (and associated guidance and procedures). All directors are accountable to the Chief Executive, the Corporate Management Team and Policy Boards for managing risks within their areas of responsibility. While service directors have accountability for the management of a risk within their service, they might not ‘own’ the risk control measures being implemented to manage the risks (e.g. implementation of policies developed by other services). In this case, the role of the director is to oversee that the controls are fit for purpose and operating effectively within their area of responsibility and liaise with directors who ‘own’ the controls should they have any concerns. Service directors and their senior management teams will be supported in their risk management responsibilities by their nominated service risk management rep who will also represent the service on the Corporate Risk Management Group. Service Risk Reps The risk reps support corporate risk management activities, representing their service on the CRMG. Risk reps attend all CRMG meetings and take part in its activities (or arrange a deputy if required). The risk reps actively promote corporate risk initiatives and training opportunities and play a valuable role in progressing risk KPIs and the Strategic Risk Management Development Plan. Locally, the reps support their directors, senior teams and colleagues to fully implement Risk Matters. The risk rep is the first point of contact for risk queries within their service. A key role for the risk rep is to bring forward the service’s risk information for reporting to Board. The risk reps raise any significant service risks that require to be considered for escalation. Risk reps also support their heads of service in providing assurance on how their ‘business as usual’ risks are being handled. 12
Page 15
All Heads of Service Heads of Service are required to ensure their employees are familiar with Risk Matters and associated guidance; they are accountable to their Director for managing risk across their remits. Specifically, heads of service will regularly review and update the risks they own, either directly or on behalf of their Director or the CMT (whether these are strategic, corporate, service or project risks). Similarly Heads of Service will be responsible for providing assurance as to how their ‘business as usual’ risks are being handled. Within their teams, the Heads of Service ensure their employees understand the risk context in which they undertake their duties, they encourage their employees to promptly report any matters of concern and make sure that risk management skills and training needs are assessed and addressed. Head of Child Care & Criminal Justice Section 3 of the Social Work (Scotland) Act 1968 requires every local authority to appoint a professionally qualified Chief Social Work Officer (CSWO). The CSWO is a ‘proper officer’ in the social work function: an officer with particular responsibility on behalf of a local authority, where the law requires the function to be discharged by a specified post holder. The Head of Child Care and Criminal Justice is the council's specified CSWO. The Chief Social Work Officer ensures the provision of effective and professional advice relating to the provision of social work services and assists understanding of the complexities of social work service delivery, particularly in relation to issues such as corporate parenting, child protection, adult protection and the management of high risk offenders. The CSWO has a role to play in overall performance improvement and significantly in the identification and management of risk insofar as it relates to social work services, including adult social work services delegated to the Renfrewshire Health and Social Work Partnership. 13
Page 16
Good risk management should be embedded in the daily activities of every employee. By ensuring that decisions on risk management are taken locally rather than centrally, the council encourages local ownership of the process. All employees are encouraged to be actively involved in identifying current and potential risks where they work. Employees should make every effort to be aware of situations that might put themselves or others at risk, report identified hazards or concerns and take action to reduce risk. To do this it is important that employees: •make sure they know the risks linked to their roles and activities; •understand that how they behave in relation to risk could impact on their own and their client’s/ the public’s safety; •make sure they know if they are accountable for particular risks and how to manage them; •understand it’s important that they can contribute to improvements in risk management and should be supported to come forward with ideas; •understand that good risk management is part of Renfrewshire Council’s ‘DNA’ and culture; and, •quickly report to their line manager where they perceive new risks or problems with how existing risks are being managed. This includes reporting any near misses they become aware of. Governance All employees 14
Page 17
Enablers - our fundamental building blocks for success; what we need to make risk management ‘happen.’ Having these components means we have evidence that risk management arrangements are in place; this is essential for providing assurance and for demonstrating compliance with industry standards that relate to risk management (such as ISO 31000) •Objectives – These are shown to the right. In working to these we can deliver benefits to the council and the measures of success include better financial outcomes, delivery of business objectives and targets, better project success rates, good outcomes from external scrutiny, fewer unexpected problems, fewer incidents, accidents or complaints, and fewer insurance claims/ less litigation. We have key performance indicators to track how well our strategy is being implemented. Strategic Risk Management Objectives Enablers (1) Leadership and management: Ensuring that our Members, Directors and Senior Managers fully support and promote risk management (2) Policy and strategy: Ensuring that our policy and strategy remain fit for purpose and maintain a consistent approach to the management of risk and increasing its effectiveness (3) People: Ensure that our people are equipped and supported to manage risk well (4) Partnerships and resources: Ensuring that we have effective arrangements for managing risks in partnerships and resourcing risk management activity (5) Processes: Ensuring that our risk management processes are effective in supporting the business activities of the council Results (6) Risk handling and assurance: Ensuring that risks are handled well and that the council has assurance that risk management is delivering successful outcomes and supporting innovation (7) Outcomes and delivery: Ensuring that risk management does contribute to achieving positive outcomes for the council 15
Page 18
Enablers – continued... •Guidance – the guidance supporting the risk policy and strategy is all available on the Intranet •People – as has been set out already in pages 10 to 14 •Training – a range of training and development opportunities are available through the risk manager •Development – our strategic risk management development plan (SRMDP) is the plan that helps us stay on track with our strategy and for meeting our objectives. The plan includes immediate, medium or longer term actions for the lifetime of the present strategy, with named responsible officers. The plan is realistic, stretching but achievable; it allows CRMG to focus on strategic priorities and actions but at the same time helps risk reps to consider operational requirements for supporting the objectives. •eSystems – we make the most of technology whenever possible. We use our MS Teams channel for recording strategic, corporate or service risks and KPIs, project management software for project risk, the intranet for policy, strategy, guidance and other risk management media, Business World for accident and incident recording and monitoring, iLearn for online courses, and we use MS Teams and channels to facilitate our CRMG meetings and comms. 16
Page 19
Risk management process Renfrewshire Council embeds risk management throughout the council using an industry accepted risk management process and applying this consistently across all services and business activities (i.e. budget setting/ projects etc), it helps us better understand risk and make better risk-based decisions. Risk Guidance note 02 is dedicated to explaining the process fully but some important points of note are set out on this page and the next. Context - takes account of many factors, including considering what type of risk is being addressed. • Strategic risks are outward in focus and represent threats or opportunities linked to the Community Plan outcomes and our two-year economic and social recovery strategies • Corporate risks are inward in focus and represent threats or opportunities linked to the Council Plan outcomes and our two-year financial recovery strategy • Service risksimpact only on the remit of the individual service, its employees/ volunteers, contractors/ partners, or the general public/ service users. Service risks can be proposed for escalation to corporate risk if they require significant central resource for risk control measures. • Project risks represent events or circumstances which may impact on a specific project - usually as a threat to schedule and/ or cost of a project or the benefits the project will deliver. Any residual risks at the end of a project are handed over to the relevant service department/s to manage. All of the above risk types can be found recorded on registers or in reports and are reported to Policy Boards or Project Boards. ‘Business as usual’ risks however are not generally related to corporate priorities or ambitions but rather are inherent by nature of our type of organisation. These risks do not go through the full risk management process but are managed via the risk assurance model launched in April 2023. 17
Page 20
Risk management process (continued) Analysing risk Two factors are used to analyse risk –likelihood of occurrence, multiplied by the severity of the consequence/s if it does. (Guidance note 04) Evaluating and treating risk The outcome of analysis is a risk score which leads to evaluation being either Low, Moderate, High or Very High. This aspect is extremely important as it links to the council’s cautious risk appetite and will determine how a risk should be treated (unless the law deems otherwise). It is generally understood by all services that usually: • low riskis acceptable without any further action to prevent or mitigate the risk; • moderate riskis tolerable - control measures implemented or introduced must be cost effective; • high riskmay be tolerable - providing the council is assured regarding the adequacy and effectiveness of the control measures in place. Any further control measures implemented or introduced must be cost effective in relation to the high risk; • very high riskis deemed to be unacceptable and measures should be taken to terminate, transfer or treat a very high risk to a more tolerable. The council recognises that in exceptional circumstances a combination of factors produce ‘very high’ risks, for which the council may have limited control (such as a global pandemic, recessions etc). While it may have the capacity to deal with some very high risk, the Council does not wish to tolerate any more than two or three very high risks at any given time, either corporately, or within the service departments . 18
Page 21
Policy Development Risk management thinking can add value by checking e.g: •Any strengths, weaknesses, opportunities or threats to delivering the new policy? •Could we be creating new risks when bringing in the new policy? •If the policy isn’t approved, what risks are we left with? Service Planning Risk management data can add value by informing us of where service improvements could/ should be made. Good sources of risk-related data include: •Complaints •Accident trends/ near misses •Claims trends/ defensibility rates •Audit reports Budgeting Finance colleagues are appraised of the financial risks associated with financial planning and setting service budget. Services can use risk information to support their applications for funding, to manage unavoidable cost pressures and associated risks. Application/ results While enablers provide the building blocks for risk management to happen and the risk managing process brings consistency in how we view and understand risk, it’s only when we apply this to our business activities that risk management starts to really add value to our organisation. Good examplesof this include: * Policy Development * Service Planning * Budgeting * Performance Management * Project management These activities are shown on the right with some practical suggestions. Performance Management Risk management thinking can add value by checking e.g: •Do poorly performing KPIs show we may have new risks arising? •If a poorly performing KPI is already linked to a risk, have our risk controls failed? Project Management Some questions that can help with checking for risk in projects include, is the project likely to deliver the desired outcomes; what may cause us to run over time, over budget or impact on quality; are we over optimistic; are our assumptions reasonable? 19
Page 22
Risk Service The council has a ‘Risk Manager,’ however managing risk and making decisions on risk, is delegated to services. The role of the Risk Manager is set out in page 11. Some examples of activities the Risk Manager leads on or is involved in are shown on the right by way of practical illustration. The Risk Manager does not operate in isolation but values collaboration, working closely with the CRMG, Risk Reps and other Risk Professionals. Supported by the Insurance & Risk Management Co-ordinator, the Risk Manager also manages the council’s insurance service, arranging policy cover, providing advice on that, and providing services such as recommending insurance requirements for tenders and checking contractors’ insurances. The Risk Manager and the Insurance and Risk Management Co-ordinator ensure their own personal development through membership of ALARM (the public sector Risk Management Association). 20
Page 23
In conclusion: The remaining pages of this strategy go beyond the risk management framework and set out some further aspects of our approach; these being: * Resourcing risk management * Measuring risk management maturity * Communicating risk management * Expectations for all services. Resourcing the council’s risk management framework Developing and leading ongoing implementation of the risk management framework is resourced through the Risk Manager role, the Corporate Risk Management Group and Risk Management Alliance. Training and education costs are minimised with the majority of courses/ training delivered in-house or external sources such as insurers or membership of ALARM (public sector risk management association). Directors will provide resource within their service to support managers’ and employees’ risk training needs. Resourcing risk owners to manage risks Service risks should influence budget allocations. Any unplanned or unbudgeted resources arising in relation to risks will be subject to review by the service director in consultation with the Director of Finance and Resources. Risk owners will ensure that responses to risk (by way of transfer or treatment) are effective and proportionate to each risk’s significance. Put simply, resources allocated to addressing risk should not exceed the cost of the exposure itself (in the case of adverse risks) or the benefits that are being sought (in the case of opportunities). The council’s Insurance and Risk Management Co-ordinator can, on request, provide guidance on the cost effectiveness of transferring risk to the council’s Insurers where this is a suitable option. The council’s Treasury consultants and investment advisors will provide guidance on risk and appropriate action in relation to the council’s investment portfolio. 21
Page 24
Measuring risk management maturity We work towards our risk management vision through our strategic risk management objectives and by seeking every opportunity to apply effective risk management practice where it will yield most benefit (such as major investment/ change programmes/ entering into new areas of business, service or partnerships), and when it will yield most benefit, (such as along the development path of major initiatives and not solely the final decision point). In working towards our risk management vision we aim to demonstrate maturity where risk management is consistently embedded and integrated* while also being able to demonstrate examples of where risk management information is driving the key policy decisions of our organisation. *Definition as per the ‘Risk Management Toolkit’ developed by ALARM Level 1 Awareness Level 2 Happening Level 3 Working Level 4 Embedded and integrated Level 5 Driving Where we should be 22
Page 25
Communicating risk management Effective communication of risk management information across all service departments and with employees is essential to developing a consistent and effective approach to risk management. Copies of ‘Risk Matters’ are disseminated to all service directors for cascade throughout their services, and copies, along with other risk management documentation and guidance are available on the Staff Intranet ‘Risk Matters’ page. Details of the council’s insurance arrangements are published on the Staff Intranet: insurance a quick guide. The details include definitions of a range of insurance terms along with key insurance documents such as the council’s Employers Liability Certificate and the standard letter from the council’s insurance brokers and advisors that summarises all the main insurances that are in place. Risk management awareness is communicated with all new employees through the induction process; through iLearn (corporate e-learning platform) and through local induction. 23
Page 26
Expectations for all services •Making the most of the risk management guidance, tools, advice and training available. •Using the risk management process wherever possible, but especially in business processes where this will add most value (page 19). This means that an assessment of risk as well as costs and benefits becomes routine wherever possible. •Identifying risk using standard methods such as ‘bottom-up’ and ‘top-down’ approaches, involving managers throughout your service with detailed knowledge of the service and the context in which it operates. •Ensuring where possible and relevant, that risks are aligned with the relevant council plans (page 17) •Using the council’s risk matrix to consistently analyse risk in terms of likelihood of occurrence and potential impact, taking into account the effectiveness of current risk control measures. •Responding to risk in a way that is proportionate to the level of risk. This means that risk may be terminated; transferred elsewhere (such as through insurance); tolerated as it is; or, treated with cost effective measures to reduce it to a level where the exposure is acceptable or tolerable for the council in keeping with its capacity for risk. In the case of opportunities, the council may ‘take’ an informed risk in terms of tolerating it if the opportunity is judged to be (1) worthwhile pursuing and (2) the council is confident in its ability to achieve the benefits, manage and justify the risk. •Maintaining risk registers or logs as a means of collating risk information in a consistent format allowing comparison of risk evaluations, informed decision-making in relation to prioritisation of resources and ease of access to information for risk reporting. 24
Page 27
•Escalating and de-escalating risk/ moving risks between risk registers when appropriate, involving service risk reps. •Reassessing individual risks within a timescale that is proportionate to the level of risk (i.e. low risks annually, moderate risks every 6 months, significant [high and very high] risks at least on a quarterly basis), taking account of how effective the related control measures are. •Participating in the 6-monthly review of strategic, corporate and service risks to be reported to the Audit, Risk & Scrutiny Board (exercise led by the CRMG), checking progress, checking for any changes in context and horizon scanning for new impacts or indeed new risks. •Completing an annual assurance exercise for ‘business as usual’ risks •Routinely considering risks and associated data (Heads of Service at 1-1s with their relevant Service Directors). •Committing to action required to support high performance of Key Risk Management Performance Indicators. •Supporting colleagues to come forward and report risks and concerns in a ‘learning’ culture that seeks to learn from past experience to build a better future, avoiding repetition of avoidable adverse events. Expectations for all services 25
Page 28
For further information, please contact the Risk Manager Email: Karen.Locke@renfrewshire.gov.uk Note: Risk Matters should be read in conjunction with all related media including the guidance notes, to be found at: http://intranet.renfrewshire.gov.uk/article/6752/Risk-Matters---The- combined-risk-management-policy-and-strategy 26