8 Risk Management Annual Report 2021-2022
Renfrewshire Council · 13 June 2022
Back to Audit, Risk and Scrutiny Board — 13 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Page 1 of 2 ___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 13 June 2022 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: Risk Management Annual Report 2021/2022 ___________________________________________________________________ 1. Summary 1.1 1.2 1.3 This paper presents the Risk Management Annual Report for 2021/22 (Appendix 1). The Report describes the corporate risk management activity that has taken place during 2021/2022 in relation to the council’s risk management arrangements and strategic risk management objectives. It is not the purpose of this paper to report on the management of specific risks as such information is already provided separately to the Board in the Risk Report, April 2022 paper. In exceptionally challenging times and with diminishing resources, the council continues to apply an appropriate level of risk management to prevent or mitigate the effects of loss or harm. In doing so, we recognise that good risk management contributes to the delivery of better financial outcomes, business objectives, better project success rates, achievement of targets and fewer unexpected problems. We purposefully promote an environment that is risk ‘aware’ rather than risk ‘averse’ and strive to place risk management information at the heart of the key decisions that we make. This means that we can take an effective approach to managing risk in a way that both addresses our significant challenges and enables innovation. ___________________________________________________________________ 2. Recommendations 2.1 It is recommended that the Board considers the content of the Annual Report and notes the significant contribution that it makes with regards to the council’s corporate governance arrangements. ___________________________________________________________________
Page 2
Page 2 of 2 3. Background 3.1 In keeping with the ‘Scheme of Delegated Functions’ a Risk Management Annual Report is provided to the Audit, Risk and Scrutiny Board each year for consideration. The report supports the council’s code of corporate governance and seeks to provide assurance to stakeholders (internal and external) concerning the risk management arrangements applied during 2021/2022. _________________________________________________________________ __ Implications of the report 1. Financial – not relevant to report recommendations 2. HR & Organisational Development – not relevant to report recommendations 3. Community/Council Planning – effective risk management supports the delivery of all community/ council plan outcomes 4. Legal – not relevant to report recommendations 5. Property/Assets – not relevant to report recommendations 6. Information Technology – not relevant to report recommendations 7. Equality & Human Rights – not relevant to report recommendations 8. Health & Safety – not relevant to report recommendations 9. Procurement – not relevant to report recommendations 10. Risk – as per the subject matter of this report 11. Privacy Impact – not relevant to report recommendations 12. Cosla Policy Position – not relevant to report recommendations 13. Climate Risk – not relevant to report recommendations ___________________________________________________________________ List of Background Papers (a) Non applicable – reports provided on a year-by-year basis ___________________________________________________________________ Author: Karen Locke Risk Manager 07506 957 037 Karen.Locke@renfrewshire.gov.uk
Page 3
Document Title: Risk Management Annual Report 2021/2022 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 13 June 2022 Review Dates: Not applicable Appendix 1 Risk Management Annual Report 2021 - 2022
Page 4
Document Title: Risk Management Annual Report 2021/2022 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 13 June 2022 Review Dates: Not applicable CONTENT 1. Introduction ......................................................................................................................... 1 2. Risk Management Framework 2021/22: Overview .............................................................. 1 3. Risk Management Infrastructure/ Enablers .......................................................................... 2 4. Risk Management Process .................................................................................................. 3 5. Risk Management Application/ Results ............................................................................... 4 6. Reporting and Monitoring .................................................................................................... 4 7. Risk Management Function/ Training and Development ..................................................... 5 8. Conclusion .......................................................................................................................... 6
Page 5
1 Document Title: Risk Management Annual Report 2021/2022 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 13 June 2022 Review Dates: Not applicable 1. Introduction 1.1 The Risk Management Annual Report is provided to the Audit, Risk and Scrutiny Board each year in keeping with its delegated function of considering the corporate risk management annual report. The Report describes the corporate-led risk management activity that has taken place during 2021/22 in relation to the council’s risk management arrangements and strategic risk management objectives. The Report does not cover the management of specific risks as such information is already provided separately to the Board in the Risk Report, April 2022 paper. 1.2 In exceptionally challenging times and with diminishing resources, the council continues to apply an appropriate level of risk management to prevent or mitigate the effects of loss or harm. In doing so, we recognise that good risk management contributes to the delivery of better financial outcomes, business objectives, better project success rates, achievement of targets and fewer unexpected problems. 1.3 We purposefully promote an environment that is risk ‘aware’ rather than risk ‘averse’ and strive to place risk management information at the heart of the key decisions that we make. This means that we can take an effective approach to managing risk in a way that both addresses our significant challenges and enables innovation. 1.4 This annual report supports the council’s corporate governance arrangements and seeks to provide assurance to stakeholders (internal and external) concerning the organisational risk management arrangements applied during 2021/22. 2. Risk Management Framework 2021/22: Overview 2.1 Below is a brief overview of the key components of the council’s risk management framework. Thereafter sections 3 to 7 of this report expand on each component and highlight specific points relevant to 2021/22 developments. (1) Infrastructure/ enablers At the heart of the council’s risk management arrangements are the strategic risk management objectives, the risk management policy and strategy and the strategic risk management development plan. Also embedded within the infrastructure are the communications systems in use for risk management information, including Pentana, the Intranet and the key policy boards and groups such as the Corporate Management Team and Corporate Risk Management Group that have a specific role in risk management. (2) Process A cyclical process for risk assessment, treatment, communication, monitoring and review of risk using a standardised risk matrix. The process and supporting matrix continue to enable a consistent approach to risk management throughout the council, set within the context of the council’s capacity and tolerance for risk, sometimes also referred to as ‘risk appetite.’ (3) Application/ results Risk management is not viewed as an isolated function or practice but is applied to other key business processes of the council, including service planning, financial planning, performance management, procurement, project management and partnerships. Applying risk management at the right time and in the right way is key to risk management adding value to the organisation and delivering tangible results. (4) Reporting and monitoring Reporting and monitoring arrangements, including individual and group roles and responsibilities for risk management, are defined in such a way as to ensure a suitable flow of risk management information throughout the council and an appropriate level of monitoring and scrutiny relating to the effectiveness of the risk management arrangements in place and progress being made in relation to activity linked to strategic and corporate risk registers and service risk management plans. (5) Risk management function For the risk management framework to be effective, it must be underpinned by training, guidance and ongoing development activity which raise awareness of how to implement good risk management practice across the council. This aspect of the framework informs the workplan of the corporate risk management function under the responsibility of the Director of Finance and Resources.
Page 6
2 Document Title: Risk Management Annual Report 2021/2022 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 13 June 2022 Review Dates: Not applicable 3. Risk Management Infrastructure/ Enablers 3.1 Risk Management Policy and Strategy In March 2021 ‘Risk Matters – the next level,’ the combined risk management policy and strategy was revised and approved by the Audit, Risk and Scrutiny Board1. In previous iterations of Risk Matters there had been incremental changes year on year as risk policy and strategy evolved over time, with Risk Matters continually being well embedded throughout the organisation and well supported by all service departments. In the revised Risk Matters, the council’s risk management vision, and risk categories were updated from April 2021 as follows: Our vision Good risk management practice will be embraced as an enabler of success, whether in times of social, financial and economic recovery, managing ongoing significant and ‘business as usual’ challenges or in pursuing opportunity and innovation. Our risk categories • Strategic risks are outward in focus and represent threats or opportunities linked to the Community Plan outcomes and our two-year economic and social recovery strategies • Corporate risks are inward in focus and represent threats or opportunities linked to the Council Plan outcomes and our two-year financial recovery strategy • Business as usual risks – a new category for those that are not generally related to corporate priorities or ambitions but rather, are inherent to our organisation simply by default of the type of organisation that we are. 3.2 Strategic Risk Management Objectives The council has historically based its self-assessment of its risk management arrangements on the ALARM2 National Risk Management Performance Assessment Model. The risk management objectives are derived from this model. The strategic risk management objectives remain relevant and continue to form the basis of the Strategic Risk Management Development Plan. 3.3 Strategic Risk Management Development Plan The Strategic Risk Management Development Plan (SRMDP) explicitly sets out the development activity that supports the strategic risk management objectives aligned to our risk policy and strategy. The SRMDP will usually be realistic, stretching but usually achievable; it is designed to allow the Corporate Risk Management Group to focus on strategic priorities and actions while 1 Risk Matters is reviewed formally every two years by Board with an interim annual review conducted by the Corporate Risk Management Group. 2 ‘ALARM’ is the public sector risk management association
Page 7
3 Document Title: Risk Management Annual Report 2021/2022 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 13 June 2022 Review Dates: Not applicable at the same time allows individual members (representing their service departments) to consider operational implications and requirements for supporting the objectives. Historically, progress against the Strategic Risk Management Development Plan (which runs in two-yearly cycles), would be monitored quarterly by the Corporate Risk Management Group however plans were paused for a number of reasons including, but not limited to, the significant tender exercise in 2021 to put in place all the council’s insurance policies (see 4.2 for more information) A new SRMDP will be developed for 2022/2024 to reflect the work to be undertaken to embed a new model for handling risks in the new business as usual risk category (see 5.5 for more information). Any incomplete actions from the expired SRDMP will be rolled forward into the new plan where still appropriate. 3.4 The Corporate Risk Management Group The revised Risk Matters approved by Board in March 2021 brought in a new and refreshed role for the Corporate Risk Management Group from April 2021 onwards. Making better use of technologies available, the Group’s activities are now not so much driven by meeting schedules but rather, use MS Teams ‘channels’ more effectively, enabling more dynamic conversations and activities in relation to risk management. Meetings do take place to check that risk owners are updating their risks and key milestones are met, such as reporting to Board, and where joint discussion and debate is required on corporate initiatives or on activities to support the Strategic Risk Management Development Plan. A key task for the Corporate Risk Management Group going forward will be undertaking ‘control deep dives.’ It is important to strike the right balance between too little control and over control of risk. Control deep dive is a valuable exercise which involves detailed investigation of specific risk controls known to be in place, where we can explore in depth how much value each control brings to managing the related risks and this helps provide assurance that risk control is proportionate to risk or identify where risks are materially over or under-controlled. Control deep dive therefore adds further value to decision-making on risk and better supports the council in implementing effective risk management arrangements. 3.5 The Intranet The intranet continues to be a key tool for communicating and providing risk management information and guidance to all staff with access to it. The Intranet risk management pages provide access to ‘Risk Matters’ and a range of supporting guidance documents and templates as well as contact details for the risk management and insurance service. 4. Risk Management Process 4.1 The standardised process for risk management within the council remains fit for purpose. The table below summarises the guidance which accompanies the process. Applying this process in all aspects of business helps officers to manage their activities and pursue opportunities in a way that helps achieve objectives and prevent loss or harm. Establish the context Services consider risk in terms of context such as key themes and objectives, service priorities, operational activities or projects, longer-term or shorter-term objectives. Identify risk Services carefully define their risks in such a way as to be clear about the situation presented (opportunity, activity, service change, problem or challenge) and the consequences that may flow from it. We have started using risk ‘bowtie’ analysis which employees are finding very visual and helpful in understanding risk. Analyse risk Services analyse risk in terms of likelihood of occurrence and should it occur, its potential impact using the standardised risk matrix. Evaluate risk Services evaluate risk in terms of significance, being either ‘low’, ‘moderate’, ‘high’ or ‘very high’ and compare this with the council’s capacity and tolerance for risk. Treat risk Services consider a range of options when deciding on the most appropriate way to address their risks, either through measures to terminate; transfer elsewhere (such as through insurance); tolerate as it is; or, treat with cost effective measures to reduce it to a level where the exposure is acceptable or tolerable for the council in keeping with its capacity and tolerance for risk.
Page 8
4 Document Title: Risk Management Annual Report 2021/2022 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 13 June 2022 Review Dates: Not applicable Note: in the case of opportunities, services may ‘take’ an informed risk in terms of tolerating it if an opportunity is judged to be (1) worthwhile pursuing and (2) the service is confident in its ability to achieve the benefits and justify the risk. Monitor and review risk Services are aware that once a risk assessment has been undertaken it is necessary to continue to monitor and review the risk for changes in context or the measures that are in place to control it. Communicate and consult Services are aware that it is good practice for at least two officers with relevant subject knowledge to undertake risk assessment (in consultation with other officers if necessary) with the key outcomes of the risk assessment process communicated to relevant persons (such as using the risk implications section on Board papers). 4.2 Related to ‘treat risk’ outlined above, a key area of success was the outcome of the procurement of the council’s insurance policies to cover its known assets and liabilities. It is essential that the council engages insurers who understand the public sector in general, but also specifically Renfrewshire’s present ambitions and challenges. The council has to balance ensuring sufficient cover with an acceptance of retaining some insurable risk (policy excesses) for a trade-off of affordable premium. Putting the council’s risks into a difficult market and securing excellent insurers at reasonable prices was a significant undertaking in 2021 involving months of work and information gathering across the whole council. A very successful outcome was achieved, and, against the general trend in the insurance market, the council achieved significant savings at policy inception on 1 November 2021. The new insurance contracts are in place for 3 years with options to extend for two further periods of two years each. 5. Risk Management Application/ Results 5.1 For risk management to truly add value for the organisation, it needs to be applied across the range of business processes in operation throughout the council and all its service departments. This section provides an outline of how this happens in practice across a range of business practices. 5.2 Risk management continued to be a key component of the council's programme and project management arrangements meaning that if risks are proactively addressed through each stage of a project, the outcomes are more likely to be achieved on time and within the planned budget. 5.3 Each service continues to monitor their risks and refresh their risk registers annually taking account of the service priorities and service improvement plans. This means that risks relating to the service priorities are proactively addressed and services are more likely to achieve their priorities and outcomes as planned. 5.4 Each year, services bring to the attention of the Director of Finance and Resources any areas of unavoidable cost pressures they are experiencing. During this process services can highlight instances where cost pressures relate to risks, and this supports effective decisions to be made in financial planning. 5.5 New in 2021 has been the commencement of development work to support better assurance around how business as usual risks are handled. It is often the case that it is the specialists for various subject matters in the council that develop the tone, policies and procedures that should be adhered to across the council. These specialisms are often referred to in risk management terms as an organisation’s 2nd line of defence. The 1st line of defence relates to how the policies and procedures are played out in practice by colleagues and services at the front line. What the new risk assurance model will deliver is a question set for each area of risk that will explore how well the risk controls are embedded at the front line. Short life working groups have now been identified and are in the process of being set up to develop the practical assurance question sets for each area of risk. This is an exciting area of development for the council with feedback from external risk consultants describing it as ‘trailblazing.’ 6. Reporting and Monitoring 6.1 The governance arrangements in place during 2021/22 have continued to ensure clear lines of accountability for risk management and continue to enable a suitable flow of risk information throughout the council. The Audit, Risk & Scrutiny Board previously received a progress report on risk in January 2022. 6.2 Each service has a representative on the Corporate Risk Management Group (CRMG). The CRMG has overseen the 2021/22 strategic and corporate risks, monitoring progress. Services have taken ownership of their risks with processes being followed for reporting, and where necessary ‘escalation’ of significant
Page 9
5 Document Title: Risk Management Annual Report 2021/2022 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 13 June 2022 Review Dates: Not applicable risks to the Corporate Risk Management Group. All five service departments submitted their risk data on time for the progress report to the Audit, Risk and Scrutiny Board as planned. 6.3 In terms of monitoring performance in risk management the council historically participated in the ALARM/ CIPFA3 benchmarking club, using the ALARM National Risk Management Performance Assessment Model. CIPFA have however now withdrawn this benchmarking club so future assessment options remain to be considered. The Performance Assessment Model nevertheless still exists and describes an organisation’s risk management maturity as: ▪ Level 1 Awareness ▪ Level 2 Happening ▪ Level 3 Working ▪ Level 4 Embedded and integrated ▪ Level 5 Driving The council aims for level 4, to demonstrate maturity where risk management is consistently ‘embedded and integrated’ while also being able to demonstrate examples of where risk management information is driving the key policy decisions of our organisation. The council performs at Level 4. 6.4 Key Performance Indicators have been implemented and monitored by the Corporate Risk Management Group, however going forward new indicators will be developed that better reflect the revised risk policy and strategy. This will follow on from the work outlined at 5.5. 7. Risk Management Function/ Training and Development 7.1 The council’s Risk Management Training Strategy ensures that we are clear about the council’s expectations as to the degree of risk management knowledge required across a range of roles within the council, and the risk management training and development solutions that are available and should be accessed through the council to enable competence and capacity to manage risk within those roles. Due to covid restrictions that remained in place during 2021, face to face training was not an option but the Risk Manager responded with 1-to-1 sessions for colleagues where these were required for personal development, and also narrated training slides on the new risk policy and strategy, to support the council’s new leadership development programme. 7.2 In normal times, in-house training and development in risk management opportunities include: ▪ Risk management sessions available via the council’s insurers ▪ Risk Management Course (½ day in-house) ▪ Topical sessions for Elected Members (on request) ▪ Project Risk Management Workshops (in-house as required) ▪ Internal audit training programme (in-house through the Audit, Risk and Scrutiny Board) ▪ Risk Management iLearn course (in-house, 45 mins) ▪ ad hoc support, advice or training as requested 7.3 Ad hoc support, advice or training requests continue to be met so far as reasonably practical. Some of these involved the council’s insurance broker, for example in relation to insurance requirements for the cultural infrastructure projects and City deal projects. 7.4 To continue to provide evidenced based training, development and advice for the council, the council’s Risk Manager maintains continued professional development in her field and is qualified to Masters Level (MSc in Risk Management awarded by Glasgow Caledonian University). 7.5 Through membership of a number of groups that include ALARM (the Public Risk Management Association), and the ALARM Scotland Group, the Risk Manager keeps abreast of risk management developments and best practice in other public-sector organisations and local authority areas. The Risk Manager now sits on the ALARM Board and is presently serving as President-Elect (shadowing the President for 2 years). This role means greater development opportunities that will in turn serve the council well. 7.6 Through the council’s contracts with Insurers and Insurance Brokers, the Risk and Insurance Team keep up to date with developments in the insurance sector in order to ensure that the council’s interests are protected. 3 Chartered Institute for Public Finance and Accountancy.
Page 10
6 Document Title: Risk Management Annual Report 2021/2022 Service: N/A Lead Author Risk Manager and the Corporate Risk Management Group Date Effective: 13 June 2022 Review Dates: Not applicable 8. Conclusion 8.1 This Report has provided an overview of risk management arrangements and activity relating to 2021/22 in regard to the council’s corporate-led risk management approach. It is intended that the report provides assurance to the Board.