Item 7 - Strategic Risks 2022-2027
West Dunbartonshire Council · 18 February 2026
Back to Audit Committee — 18 February 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
WEST DUNBARTONSHIRE COUNCIL Report by Chief Officer – People & Technology Audit Committee: 18th February 2026 ___________________________________________________________________ Subject: Strategic Risks 2022-2027 1. Purpose 1.1 To provide an update on the strategic risks for 2022-27. 2. Recommendations 2.1 It is recommended that the Committee: Note the strategic risks as detailed at Appendix 1, and Endorse the removal of risk SR005. 3. Background 3.1 The Council’s 2022 – 2027 strategic risks were agreed by the Corporate Services and Audit Committees in November 2022. The appended risks have been reviewed with re-assessment undertaken before being reported to this committee. This report is submitted as agreed to Audit Committee on a bi- annual basis. 4. Main Issues Strategic Risk 4.1 In line with the Council’s Risk Management Framework, a re-assessment of the strategic risks has taken place as detailed within Appendix 1. Each risk is managed through internal controls, linked actions and associated milestones with the objective being to reduce or stabilise the level of risk through completion of linked actions over a period and/or ensure mitigation factors are adequate should the risks actually materialise. 4.2 Table 1 represents a risk dashboard that includes information on the original, current and target rating for each strategic risk, as well as an assessment of the current risk status. Each strategic risk is identified and supported by more detailed information available on a “drill-down” basis in Appendix 1. Six strategic risks associated actions and milestones are met and are progressing as expected whilst getting closer to reaching their assigned targets. SR001, SR007, SR008, and SR011 are currently off target, which is explained in further detail below. ITEM 7
Page 2
4.3 Following feedback from the Audit Committee meeting in September 2025, a strategic review has been undertaken of SR005 ‘Engaging Positively with Residents, Communities and Partnerships’. The review concluded that this area no longer meets the criteria for a strategic risk and compared to other strategic risks the milestones are less definitive and more challenging to measure. This may lead to reporting being more subjective and unreliable. It is recommended that SR005 be removed from the Strategic Risk Register. The Chief Officer for Regulatory and Regeneration will assess whether the residual elements of this risk should alternatively be monitored and managed at a service level.
Page 3
Table 1 Key Strategic Risk Information Strategic Risk Original Risk October 2022 Current Risk February 2026 Target Risk March 2027 Risk Status Rationale SR 001 Significant financial funding reductions/limitations from Scottish Government SR 002 Challenges in implementing broad- ranging school improvement to raise attainment and achievement SR 003 Maintaining Council Assets that are fit for purpose SR 004 Keeping abreast of developments in the innovative use of Information Technologies SR 005 Engaging positively with Residents, Communities & Partnerships SR 006 Challenges in protecting the Health and Safety of Employees and Others SR 007 Complexities in ensuring an appropriately resourced and resilient workforce
Page 4
Risk Methodology and Reporting 4.3 Each strategic risk is populated in Pentana in terms of the following template: Risk title and code; Description; Ownership; Potential effect; Measures of impact; Risk factors; Internal controls; Risk opportunity; and Linked actions. 4.4 Each risk has been scored using a “4 x 4” matrix for likelihood and impact in relation to: Current risk (with review dates set at pre-determined intervals); and Target risk (i.e. 31 March 2027 - the duration of the Strategic Plan). The risk descriptors used in the “4 x 4” matrix are as follows: SR 008 Threat of Cyber Attack SR 009 Challenges in delivering effective services in relation to Roads & Neighbourhoods SR 010 Failure to maintain Housing Stock SR 011 Inability to reduce carbon footprint in line with targets
Page 5
Likelihood Score Descriptor 1 Unlikely 2 Likely 3 Very likely 4 Certain Impact Score Descriptor 1 Minor 2 Moderate 3 Significant 4 Critical 4.5 For ownership, each strategic risk is “Managed By” a Chief Officer and “Assigned To” a Senior Officer. Strategic risks are also reported on a bi- annual basis to the Performance & Monitoring Review Group. Service Risk 4.6 Following the methodology in 4.3 to 4.4 above, each service has owned operational risk registers in Pentana (the Council’s performance system) which were reviewed as part of the 2025/26 service planning process. 4.7 Significant financial funding reductions/limitations from Scottish Government It is expected the Council will continue to be faced with significant real term funding reductions from the national settlement. This is based on the Spending Review published by the Scottish Government in January 2026 which sets out multi-year spending plans over the three-year period 2026/27- 2028/29 across the various portfolios. It illustrates that Local Government funding, in cash terms, is expected to decrease by 0.07% over the three-year period which will require councils to absorb the financial pressures brought about by all inflationary increases. 4.8 Threat of Cyber Attack This risk will always be high as the threat and likelihood of a Cyber Attack remains. The UK public sector is still experiencing elevated levels of targeted Cyber-attacks including recent attacks on Scottish councils. As this risk continues to be high the emphasis remains on proactive measures to protect the confidentiality, integrity and availability of our data, critical infrastructure, and overall business operations. Key risks and continual threats include:
Page 6
Geopolitical threat increasing due to current world tensions. Russia is recognised by national security operations as the world’s largest cyber threat actor. Demand for emerging technologies such as Artificial Intelligence solutions present new challenges for the council to implement and secure. Risk to Backup technology and corruption of council data. Ransomware attacks – surge in recent years, potential for significant financial loss and operational disruption. Advanced Persistent Threats (APT’s) – sophisticated stealthy attacks conducted by well-resourced groups, targets include critical infrastructure, government bodies and large corporations. User awareness – Phishing attempts on the rise with more sophisticated techniques being deployed including voice and text phishing. Targeted threats tailored to specific areas of the Council are being observed. Social Engineering and ‘old school’ cyber-attacks now present a higher risk. Third Party Risks – The Council often relies on third party vendors and suppliers, increasing the risk of cyber-attacks through the supply chain. Mitigations: Implementation of a new Cyber Incident Logging and Response system (MDR) offering enhanced protection. Continual improvement of our vulnerability/patch management systems and processes. Continual promotion of Cyber awareness through simulated phishing campaigns supported by our online security training and awareness platform. Social Engineering guidance issued to all employees with new ‘Be Cyber Smart’ campaign. Engagement with ICT Security Partners to highlight and advise on specific areas of risk. Continual assessment and improvement of our Cyber Security posture. Robust Business Continuity and Disaster Recovery plans with a new ICT backup policy in place. Progress continues to take place to improve our security posture in line with the national Public Sector Action plan (PSAP) and Public Sector Network (PSN) compliance. Vigilance of the National Cyber Security Centre (NCSC) Cyber Security and Scottish Government (SC3) guidance continues to remain in place. 4.9 Complexities in ensuring an appropriately resourced and resilient workforce The risk rating remains scored at a 6. The difficult funding position means an impact on an appropriately resourced and resilient workforce is expected, this is now starting to become clear in the employee engagement measures in place with fewer employees feeling valued than last year as reported at JCF in September 2025. It is unlikely that this change will be reversed whilst services continue to review structures and service delivery models in response to the Council's financial challenges.
Page 7
The Workforce Planning Strategy is in place for 2022-2027. Additionally, the People First Strategy covers the same period and consolidates several areas: well-being, employee engagement, workforce planning, learning and development and digital. A robust package of wellbeing resources continues to be available, the council is recognised as a leading employer in terms of adapting flexible working practices, attendance levels are closely monitored, with personal stress and minor ailment absences currently prevalent. Digital improvements continue to be prioritised with the ongoing roll out of M 365 Share point and the Fit for Future programme now focussing on corporate processes with a view to identifying and reducing waste and duplication. Reductions across the people support functions mean that there are ongoing challenges in supporting services and this is being mitigated where possible by using digital tools to free capacity and focussing on essential service delivery activity, but it should be noted that service levels have been impacted with certain activities ceasing such as regular HR attendance at management meetings. 4.10 Inability to reduce carbon footprint in line with targets The Council's emissions for 2024/25 were reported in November 2025 showing significant progress; 28.3% reduction on the previous year, 44.7% reduction on 2012/13 baseline and 17.9% ahead of projected target. These are positive steps however the main reduction is from the Council's scope 3 waste emissions, which is a result of shifting a significant amount of waste from landfill to incineration through the Net Zero Cooperation Agreement with Glasgow City Council. Both scope 1 and 2 emissions increased slightly for 2024/25 period. To reach a 61% reduction by 30/31 we need to reduce a further 16.3% in just over five years and investment in required to reduce gas, electricity and diesel consumption. The long-term Climate Change Coordinator vacancy has been filled internally; this currently leaves another vacancy within the energy team that will be filled as soon as possible. Participation from service areas has increased at Climate Change Action Plan meetings and emission reductions actions and projects are forthcoming. The Council also has the opportunity to utilise ClimateView and track trajectory to Net Zero, allowing actions and projects to be prioritised and a more collective, strategic approach to be implemented. The Council may be able to reduce the risk assessment of non-delivery of carbon emissions targets, but further consideration is needed
Page 8
5. People Implications 5.1 There are no people implications associated with this report, other than in relation to the mitigation of risk. 6. Financial and Procurement Implications 6.1 There are no financial and/or procurement implications directly associated with this report however there are in relation to any expenditure linked to mitigation. 7. Risk Analysis 7.1 Failure to ensure robust risk management is likely to result in the Council being criticised by External Auditors for not having an integrated approach to embedding risk management within the authority with the result that a “no scrutiny required” status would not be achieved. 7.2 Progressing with a robust risk management approach will demonstrate that the Council is taking ownership of risk management and ensuring effective measures are in place. The ability to demonstrate risk ownership should benefit the Council in terms of: Understanding risk and its potential impact on the Council’s priorities and objectives; Reducing insurance premiums going forward by recognising that a mature approach to risk management will contribute to a reduction in the number and value of claims across a range of insurance classifications; Contributing towards incident prevention based upon post-incident investigation; Meeting statutory/regulatory requirements; and Ensuring better partnership working with external and internal partners. 8. Equalities Impact Assessment (EIA) 8.1 EIA 548 notes the positive impacts of an approach to risk that integrates considerations on equalities, human rights health and social and economic impacts that is aligned with the content of the new Strategic Plan. 9. Consultation 9.1 The strategic risks have been discussed with the Chief Officers and senior management. The reports to committee are available to the Trades Union and consultation undertaken as required. 9.2 The strategic risks have been cross checked with WD HSCP. This ensures that issues affecting HSCP are reflected within the wider council strategic risk report.
Page 9
10. Strategic Assessment 10.1 At its meeting on 26 October 2022, the Council agreed that its four main strategic priorities for 2022 - 2027 are as follows: Our Communities - Resilient and Thriving Our Environment - A Greener Future Our Economy - Strong and Flourishing Our Council - Inclusive & Adaptable 10.2 The strategic risks have been identified to complement and underpin all strategic priorities. Name: Victoria Rogers Designation: Chief Officer People & Technology Date: 30th January 2026 Person to Contact: Harry McGhie, Risk & Health and Safety Officer Harry.McGhie@west-dunbarton.gov.uk Appendices: Appendix 1: Detailed Strategic Risk List Background Papers: West Dunbartonshire Council Strategic Plan 2022-2027 Risk Management Framework EIA screening
Page 10
No embedded text on this page.