Item 05 Appendix 1
West Dunbartonshire Council · 2 September 2026
Back to Audit Committee — 2 September 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
1 Official Strategic Risk Report Generated on: 31 July 2026 SR 01 Significant financial funding reductions / limitations from Scottish Government It is expected the Council will continue to be faced with significant real term funding reductions from the national settlement. This is based on local government settlements in recent years (with the exception of 2025/2026). This coincides with a period where costs and demographic pressures are continuing to rise in relation to social care, significant inflationary increases and pay award pressures linked to inflation. Current Risk Matrix Last Review Date Current Rating Target Risk Matrix Target Date Target Rating Assigned To 27-Jul- 2026 16 31-Mar-2027 4 Laurence Slavin Potential Effect Shortfall in finances resulting in the Council being unable to provide all services as intended and needing to identify further cuts to services to deliver a balanced budget. This extends to those services delegated by the Council to the Health and Social Care (HSCP) Board. Measures of Impact - Real terms reduction in Scottish Government settlement - Demographic change (population decline/growth, aging population) - Cost reduction required including reducing level and/or quality of service provision - Increased Debt (collection of Council Tax, HRA rents, etc) -Depletion of reserves Risk Factors - Insufficient funding to retain essential services and fully fund policy commitments. - Lack of time to plan for changes in the level of grant funding due to single year settlements - General inflationary factors - Instability of Bank of England Base Rate - Significant additional cost pressures, driven by demographic profile. - Insufficient capital receipts to cover loan repayments (creating a revenue pressure) Internal Controls - Long Term Financial Strategy - Regular Financial Updates to Council - Monitor and maintain General Services and Housing Revenue Account prudential targets - Reporting and monitoring of Treasury Management Strategy - Budgetary control process - Regular budgetary control and savings monitoring reports provided to CMT and Council / committees - Active engagement with HSCP Chief Officer on financial performance and budget planning - Rigorous debt collection processes - Annual Internal Audit Plan - Work of External Auditors (external control) - Annual Governance Statement Latest Note It is expected the Council will continue to be faced with significant real term funding reductions from the national settlement. This is based on the Spending Review published by the Scottish Government in January 2026 which sets out multi-year spending plans over the three-year period 2026/27-2028/29 across the various portfolios. It illustrates that Local Government funding, in cash terms, is expected to decrease by 0.07% over the three-year period which will require councils to absorb the financial pressures brought about by all inflationary increases. Risk Opportunity -Significant council projects focusing on long term economic development in the West Dunbartonshire area to grow the local economy and generate revenue - Annual exercise to identify efficiencies - Projects to implement new ways of working (e.g. digitisation, automation, asset management) Linked Actions Code & Title Progress Status Assigned To RES/26-27/001 Commence the implementation of the new Financial Management System Carol Alderson; Arun Menon
Page 2
2 Official RES/26-27/002 Review ways of decreasing corporate debt through continued improvements to debt collection processes in relation to sundry, non-domestic rates, Council Tax and rent Ryan Chalmers RES/26-27/003 Review ways to improve rent collection rates in conjunction with Housing and W4U Ryan Chalmers RES/25-26/004 Review ways of decreasing corporate debt through continued improvements to debt collection processes in relation to sundry, NDR, Council Tax and rent Ryan Chalmers RES/25-26/005 Review ways to improve rent collection rates in conjunction with Housing and W4U Ryan Chalmers SR 02 Challenges in implementing broad-ranging school improvement to raise attainment and achievement This risk concerns delivering excellence and equity for children and young people. National and local indicators have been set to monitor progress with outcomes relating to attainment and achievement with a key focus on making progress to narrow the poverty related attainment gap. Scottish Equity funding devolved to local authorities aims to deliver on priorities between 2023-26. This funding will end in 2026. Current Risk Matrix Last Review Date Current Rating Target Risk Matrix Target Date Target Rating Assigned To 31-Jul- 2026 6 31-Mar-2027 2 Julie McGrogan Potential Effect Improved outcomes for young people would not be attained and achieved. The Council would fail to meet the needs of individual learners particularly those children and young people most disadvantaged by poverty. Risk of reputational damage to the service and the wider Council if outcomes and targets not as education as a statutory service is subject to close scrutiny of local authority performance with outcomes for children and young people by the local community and by the national agencies. Measures of Impact Stretch Aims and Targets for attainment and achievement 3-18 et to be achieved by 2026. The Stretch Aims are scrutinised annually by Scottish Government and Education Scotland. West Dunbartonshire Performance Targets for attainment and narrowing the poverty related attainment gap in Early Years, Broad General Education and Senior Phase West Dunbartonshire Improvement Board Quality Indicator Evaluations National Qualifications Attainment and Achievement Results Broad General Education Achievement of Level Results West Dunbartonshire Scottish National Standardised Assessment Data Positive Destination Data West Partnership Attainment , Equity and Destination Performance Measures Her Majesty’s Inspectors of Education inspection reports Stakeholder Feedback Risk Factors Reduced funding 2022 -2026; no confirmation of future funding from 2026: This Strategic Priority has been supported by Scottish Government Attainment Challenge Funding since 2015 and since 2022 Strategic Equity Funding. Also, schools in West Dunbartonshire have received Pupil Equity Funding since 2016. The national funding streams are committed to until 2026 – there is uncertainty as to future funding provision. From 2022 – 2026 the Strategic Equity Fund is being tapered with annual reductions in the funding the local authority receives. This will reduce resources available to deliver work streams related to SEF at a time with an increased proportion of children and young people with ASN and EAL; combined with high levels of deprivation persisting in West Dunbartonshire. Internal Controls -Strategy for Excellence and Equity 2023 – 2026 ( developed to embed improvements achieved and support an exit strategy from Strategic Equity Funding by 2026). -Project management by Senior Education Officer -Education Improvement Board chaired by Chief Education Officer -Scrutiny by Scottish Government and Education Scotland (progress reports produced and submitted) -WDC Improvement Framework -Termly progress reports submitted as part of Educational Service committee reports -Relevant Continuous Professional Development programme to support education staff -Meetings between WDC and Education Scotland/Her Majesty's Inspectors of Education -BGE Attainment and Performance Data -Literacy, Numeracy and HWB Steering Group
Page 3
3 Official -National Improvement Framework (NIF) -Education Recovery Plan Latest Note As the result of interim assessment analysis, we anticipate a dip in attainment as predicted in our trend analysis in the last two academic sessions. Whilst positive gains have been made for children in our most deprived areas the annual progress made has been impacted by: • increased numbers of children with additional support needs; • reduced Strategic Equity Fund; • reduced roll profile. Risk Opportunity Improved attainment - improved attendance - reduced exclusions - reduced violent incidents - reduction requirement for targeted support over time - reduction requirement for specialist placements over time - improved learning & community engagement - children/pupils at risk identified earlier and more effectively - more empowered community providing self-sustaining peer support - increase in the percentage and range of positive destinations over time - increased access to digital learning resources Linked Actions Code & Title Progress Status Assigned To ED/25-26/003 Close the attainment gap between the most and least disadvantaged children and young people Julie McGrogan ED/25-26/004 Improve attainment, particularly in literacy and numeracy Julie McGrogan ED/25-26/005 Improve skills and sustained, positive school leaver destinations for all young people Andrew Brown ED/26-27/001 Place the human rights and needs of every child and young person at the centre of education Claire Cusick ED/26-27/002 Improve children and young people's health and well being Claire Cusick ED/26-27/003 Close the attainment gap between the most and least disadvantaged children and young people Julie McGrogan ED/26-27/004 Improve attainment, particularly in literacy and numeracy Julie McGrogan ED/26-27/005 Improve skills and sustained, positive school leaver destinations for all young people Andrew Brown SR 03 Maintaining Council Assets that are fit for purpose The risk that the Council's assets and facilities are not fully fit for purpose with consequent adverse impact on our ability to deliver efficient and effective services. Assets included in this assessment are; the Council’s property portfolio. Current Risk Matrix Last Review Date Current Rating Target Risk Matrix Target Date Target Rating Assigned To 15-Jul- 2026 2 31-Mar-2027 2 Michelle Lynn Potential Effect - Assets are not utilised in the most effective and efficient manner - Service cannot be properly delivered to the satisfaction of service users - Service users require to seek alternative service provision -Increase in reactive maintenance costs/ demand/ volume -Council assets in poor conditions -Council assets fail to meet relevant standards which are reported to either Scottish Government and/or Care Inspectorate. Measures of Impact - Condition surveys - Suitability surveys - Customer perceptions of service delivery - Investment levels in upkeep and improvement of asset base and facilities -Asset user satisfaction - Operating costs and savings Risk Factors - Adequacy of funding available to improve asset base
Page 4
4 Official - Adequacy of staff resources allocated to the area of asset management - Council buildings/assets deemed to be unfit for existing purpose - Economic conditions may reduce level of potential capital receipts from surplus property sales - Increase public liability claims Internal Controls - Corporate Asset Framework - Learning Estate Strategy 2020-2030 - Property Asset Plan 2023-2028 - Property and Land Disposal Strategy - Capital project meetings are carried out regularly in addition to project specific meetings and Building Services/Asset Management monthly meetings - Capital Programme - Strategic Asset Management Group - Learning Estate Project Board - Detailed asset database that shows relevant information on a property by property basis in relation to operational, non-operational - Sustainability Policy Latest Note The risk score remains low due to the continued delivery of the Council's capital investment programme, implementation of the Property Action Plan 2023-2028 and ongoing monitoring through established governance arrangements including the Strategic Asset Management Group. Whilst financial pressures continue to create challenges in maintaining and improving the asset base, assets are actively reviewed and investment is prioritised based on condition, suitability, statutory compliance and service need. This supports the Council's ability to maintain assets that are fit for purpose and deliver effective services. Risk Opportunity -Enhance reputation of Council by being able to improve Council assets. -Estate, assets and service delivery (e.g. new school buildings, operational building upgrades, office and depot rationalisation projects) - Enhance employee "feel good" factor by providing modern office accommodation equipped with up to date IT facilities -Improved satisfaction from public building users - Secure external funding for development of assets (e.g. EC, lottery, Historic and Environment Scotland) - Prioritised Building Upgrade Plan Linked Actions Code & Title Progress Status Assigned To RES/26-27/005 Progress the disposal of key strategic sites Michelle Lynn RES/26-27/011 Develop and implement plans and support services to achieve the asset related savings agreed by Council Michelle Lynn RES/25-26/007 Progress the disposal of key strategic sites Michelle Lynn RES/25-26/012 Develop and implement plans and support services to achieve the asset related savings agreed by Council Michelle Lynn SR 04 Keeping abreast of developments in the innovative use of Information Technologies Failure to keep pace with changing technology environment Current Risk Matrix Last Review Date Current Rating Target Risk Matrix Target Date Target Rating Assigned To 27-Jul- 2026 2 31-Mar-2027 2 James Gallacher; Patricia Kerr; Dorothy Nicolson Potential Effect A lack of consistent, sufficiently robust service planning in respect of ICT arrangements is likely to result in the Council being ill prepared to meet future demands in key service areas and lacking the capacity to respond effectively to changing need such as increased requirement for remote working as identified during covid pandemic. Measures of Impact • Close relationship and working practices with council Asset Management Service regarding property rationalisation.
Page 5
5 Official • Implementation of mobile and flexible working, enabling a downsizing of required office accommodation as people to work more efficiently and to adopt a more flexible policy towards office accommodation and desk provision. • Number of systems that have supplier maintenance contracts. – annual process. • Invocation of Service Business Continuity Plans and ICT Disaster Recovery plan • Degree of compliance with security controls to prevent data loss through poor o/s patching, cyber- attack, firewall configurations, switch replacements/upgrades etc • Fit for purpose primary and secondary data centres • Modern Wi-Fi technology in all council locations. • Broadband speed in the Council area - WDC has 2nd highest broadband speeds in Scotland. Investigating funding options for fibre network. • Number of ICT Service Desk incidents resolved within half day - exceeded the target and higher target set. • Extent of functionality development in key Council systems (i.e., lack of development beyond base system leading to ineffective management information) – several channel shift projects delivered, and more are in progress. PSN/Risk/challenging. Support service areas. • Fit for purpose Council website, delivering information and services to a significant percentage of the Council's customers. • Provide efficient desktop services supporting laptops, Chromebooks, PCs, Thin client terminals to meet changing workforce flexibility and property rationalisation requirements. 5-year Device replacement programme in place. Risk Factors • Insufficient resourcing of ICT developments so that benefits and opportunities identified are not realised • Lack of network security controls implemented. I. e Lack of intrusion detections alerts • failure to respond to audit / PSN test findings and recommendations, • insufficient resources allocated to security tasks. However, Service redesign and ICT resources aligned to security tasks and improved monitoring processes and tools as well as additional tools purchased to help support remote working environment all help to mitigate this risk. • Insufficient Service Business Continuity Plans and/or Disaster Recovery Capability. • Lack of project and programme change management arrangements. • Poor quality of mobile communication provision. • Lack of uptake on channel shift. Internal Controls - Ongoing Capital programme established for technology refresh projects - Information & Communication Technology (ICT) Policies such as ICT Security Framework - Governance structures such as ICT Steering Board, Education ICT Steering Board, Digital Transformation Board in place to support governance, integrated planning and decision making in relation to ICT -Use of both internal IT resources from across the Council and skilled specialist consultants in key areas - Fit for purpose primary and secondary data centres Latest Note April 2026 The Council continues to embrace innovation through the delivery of several service improvement projects. The Council’s legacy telephony system was replaced in 2026 with a new cloud-based platform, enabling the implementation of a modern Contact Centre solution and supporting Customer Services to enhance communication with citizens. Investment in cloud services continues, with corporate service areas currently migrating to Microsoft SharePoint and OneDrive. It is anticipated that all services and partners will be migrated by September 2026, at which point the project will be completed. Microsoft Copilot Chat has been deployed across the Council, helping employees save time on day-to-day tasks. ICT is planning a pilot of Copilot for Microsoft 365, which will support deeper integration across Council data and systems. The People & Technology teams are also exploring the use of AI agents to help service areas automate workflows and processes. The SWAN (Scottish Wide Area Network) project to increase bandwidth capacity across Council sites has been completed, with 80 sites migrated to the new network. In addition, ICT upgraded the Council’s internet connection and the Aurora Data Centre to 10Gb, strengthening the Council’s digital-ready infrastructure. ICT has also launched a live chat service that enables employees to raise ICT incidents and requests directly with Service Desk analysts. The service has been well received by Council employees. ICT is also supporting service areas with a range of technology pilots, including AI note-taking within HSCP and the implementation of new finance and planning systems. Risk Opportunity -365. Provide Council employees with secure access to email and supporting systems from anywhere.
Page 6
6 Official -Opportunity to redesign infrastructure and introduce new tools and security measures to support hybrid working environments. – - Annual network penetration tests and for PSN compliance audit - Annual External Audit on ICT Controls - Continued investment in ICT infrastructure and its focus on network security and resilience. - Provide appropriate technology for employees, pupils, and service users as well as for ICT support teams - Rationalise IT systems - Increased use of mobile devices e.g., laptop/tablet devices and Chromebooks - Review of device strategy and efficient/effective approach. - Provide self-service style systems to employees and citizens Linked Actions Code & Title Progress Status Assigned To P&T/26-27/ICT/03 Implement next phase of Microsoft 365 Sharepoint & One Drive James Gallacher P&T/26-27/ICT/04 Complete review of devices due to be replaced James Gallacher; Dorothy Nicolson P&T/26-27/ICT/05 Review and explore next generation technologies,including AI agents James Gallacher P&T/25-26/ICT/03 Develop and Implement next stage of Microsoft 365 roadmap James Gallacher; Patricia Kerr P&T/25-26/ICT/04 Complete review of ICT devices due to be replaced James Gallacher; Patricia Kerr; Dorothy Nicolson P&T/25-26/ICT/05 Review and explore next generation technologies Andrew Cameron; James Gallacher; Patricia Kerr; Dorothy Nicolson SR 06 Challenges in protecting the Health and Safety of Employees and Others Failure to meet the Council’s duty to protect the health, safety and welfare of its employees and other people who might be affected by its business Current Risk Matrix Last Review Date Current Rating Target Risk Matrix Target Date Target Rating Assigned To 27-Jul- 2026 4 31-Mar-2027 4 Louise Hastings Potential Effect Poor health and safety culture within the organisation leading to; Risk of an employee, service user, pupil (young person) or member of the public being seriously / fatally injured by fault of the Council; reputational risk regarding negative publicity; financial risk in terms of claims management compensation to the injured party; increase in insurance premiums; risk of prosecution by the HSE resulting in a fine and/or a Council Employee being subject to criminal charges, poor employee morale, high staff turnover leading to diminished service delivery. Measures of Impact Resources associated with in-house/HSE investigation. Incident statistics. Service delivery impact in terms of injury-related absence and potentially enforced cessation of work activities. Impact of injury on employees/members of the public, legal proceedings, financial penalties, potential reputational damage and risk of criminal charges. Hazard reporting. Actions at health and safety committees. Implementation of Corporate health and safety plan. Risk Factors Lack of resources, inadequate Safety Management Standards and H&S strategy. Poor health and safety culture. Under reporting of incidents. Blame culture. Poor communication between management and employees. Competent advice. Internal Controls •Competent health and safety advice readily available from the Corporate H&S team. •Corporate health and safety plan developed and monitored via Pentana. •Robust health and safety management system, FIGTREE. • Council has in place a robust H&S policy, Safety Management Standards and Fire Risk Management Strategy that includes service specific health and safety plans, duties and responsibilities for Chief Officers, managers and employees. • Adequate H&S resources in place to that will allow statutory obligations in terms of the Health and Safety at Work etc. Act and supporting legislation.
Page 7
7 Official • Embedded H&S culture that discusses H&S issues at senior level and cascades throughout the organisation through the health and safety committee system. • Monthly reports to PMRG on organisational safety performance and issues. •Chief Officers attend service H&S committees on a quarterly basis. • Workplace inspection and audit programme. • Service risk profiling. • H&S training needs analysis for every employee group. • The Council has in place a Trade Union Health and Safety Partnership Agreement. • Council promotes health and safety training for TUs to diploma level. • Hazard reporting module via FIGTREE. • Health & safety e-learning package. • Risk assessment working groups for service areas and review process. Latest Note Corporate H&S are actively reviewing and optimising key service areas, including Safety Management Standards and training. Work is also being carried out to refine and simplify the health surveillance process in collaboration with OH and line managers. The ongoing management of H & S within the Council includes overseeing the management workplace inspection programe. Alongside this the Corporate H&S team are conducting inspections, noise monitoring, completing audits benchmarking against the councils safety management standards, scaffold inspections and facilitating training. Additionally, the Corporate H&S team manage and facilitate the monitoring of risk assessments council wide to ensure all risk assessments are up to date and relevant. Fire safety management remains a priority for the Corporate H&S team. The team are conducting fire risk assessments in line with the teams annual H&S plan for 26-27. The team are also providing fire safety training to staff within HSCP and on an ad-hoc basis to other services across the council. The Corporate H&S team also regularly provide updates to PMRG on the status of overdue actions. In doing this there has been a marked reduction in the overall number of overdue actions. This forum allows Corporate H&S to have closer ties with management across the council which in turn facilitates a more proactive approach for the management of H&S. No change to risk matrix. Risk Opportunity Demonstrate to committees, elected members, Trade Unions, employees, the community and other external partner’s evidence of robust H&S culture. Good knowledge and awareness of health and safety throughout all services. Positive relationship with Corporate health & safety team and all services. Reduced incidents, costs and absence rates. Linked Actions Code & Title Progress Status Assigned To P&T/26-27/P&C/03 Continue to embed key Health and Safety practices – Prioritise cross skilling in and developing team knowledge of Health Surveillance. Louise Hastings SR 07 Complexities in ensuring an appropriately resourced and resilient workforce Failure to ensure that there is an appropriately resourced and resilient workforce in place to meet future organisational needs, in effectively executing the Council’s 2022-27 Strategic Plan. Current Risk Matrix Last Review Date Current Rating Target Risk Matrix Target Date Target Rating Assigned To 27-Jul- 2026 6 31-Mar-2027 2 Louise Hastings Potential Effect Inability to deliver services effectively Reduced level of service HSCP - workforce capacity, recruitment and retention challenges; appropriate training for roles Lack of improvement or increase in staff absences Council underachieves as an organisation Low staff morale Employee conflict and increase in associated costs Increased turnover Inability to attract/recruit
Page 8
8 Official Measures of Impact - Access to and participation of employees in learning and development activities - Absence rate and trends - Employee turnover - Grievance, discipline and other monitoring information - Employee voice and associated actions - Reports from external scrutiny bodies and award bodies - Benchmarking with appropriate comparators Risk Factors - Inability to attract/recruit - Lack of appropriate development - inadequate skills -risk to new models of service delivery - Lack of resource/capability to deliver - Workforce unable to adapt to change Internal Controls - HR processes designed to meet service delivery needs - Develop new structures to reflect strategic priorities and aligned to Standard Operation Model (SOM) - Align workforce plan to the Council's strategic planning processes (i.e. have the right people available at the right time with the right skills to fulfil properly all of the Council's strategic priorities) - Periodic review of pay arrangements in accordance with EHRC guidance (currently every 3 years) - Incorporation of succession planning into workforce planning framework - Identify training programmes to upskill staff - Effective use of SWITCH to support alternative careers - Flexible HR policies, in particular People First covering workforce planning, learning & development (including elearning), digital/continuous improvement, employee wellbeing & engagement. - Effective use of Occupational Health Service - Robust Be the Best Conversations process - Effective leadership and management behaviours, practice and programmes Latest Note Workforce Planning Strategy in place for 2022-2027. People First Strategy is in place covering 2022-2027 and this is a consolidation of a number of areas: well- being, employee engagement, workforce planning, learning and development and digital. WDC continue to offer a range of flexible working practices and have a range of employee supports in place that are reflective of best practice. However, absence levels continue to be high with little change in the top 3 reasons for sickness absence. Absence continues to be monitored through committee and management practices and improvements are currently being made to the Supporting Employee Wellbeing procedure that will improve data and strengthen the organisation’s ability to measure the effectiveness of absence management interventions. A range of communication tools and channels are regularly utilised to ensure that employee voice is heard and key information is shared with the workforce. Engagement measures are continue to show a downward trend in relation to the workforce feeling valued, which is inkepping with the wider public sector and is in the context of the ongoing financial challenges and resulting restructure exercises to deliver savings options. Maximising digital tools and solutions to aid the workforce continues with the ongoing rollout of M365 Sharepoint and the Fit for Future programme focussing on corporate processes to identify efficiencies, starting with the Supporting Employee Wellbeing process. Additionally, the Digital team continue to highlight digital learning resources and tools available to aide adoption levels. Resources in the people support functions continue to be limited impacting on the scale of pro active improvement work that can be undertaken and presenting challenges in supporting services. Risk Opportunity - Identify previously unknown skills and talents in the workforce - Realise the potential of staff Linked Actions Code & Title Progress Status Assigned To P&T/26-27/P&C/05 Prioritise digital improvements to Strategic HR service delivery Louise Hastings P&T/26-27/P&C/01 Progress the plan to mainstream digital transformation across the council Louise Hastings
Page 9
9 Official P&T/25-26/P&C/04 Improve employee life cycle and optimise employee development opportunities Leeanne Galasso; Louise Hastings P&T/25-26/P&C/06 Undertake a strategic review of job profiles across the Council John Duffy; Louise Hastings; Lisa MacGregor SR 08 Threat of Cyber-attack Data, systems and/or infrastructure are impacted as result of security attacks which are increasing in number at a time when this threat is already placing demands on resources to deliver increased levels of security controls. Current Risk Matrix Last Review Date Current Rating Target Risk Matrix Target Date Target Rating Assigned To 27-Jul- 2026 9 31-Mar-2027 4 Andrew Cameron; James Gallacher; Patricia Kerr Potential Effect • Remote working could be impacted for Council employees and partners HSCP, VJB and WDL by loss of internet services. • Disruption to services impacting service delivery to citizens • Employee and Citizen data loss with the potential for misuse such as identity fraud • Misinformation being delivered to the public via WDC communication channels • Potential for significant fines currently under the Data Protection Act and from May 2018 under the provisions of the General Data Protection Regulations • Reputational damage • Redirection of resources to deal with the impact of an attack and away from BAU work • Potential for significant fines currently under the Data Protection Act and from May 2018 under the provisions of the General Data Protection Regulations • Reputational damage • Inability to provide a secure information management network for Council and partners including HSCP, VJB and WDL. Measures of Impact • Obligation to secure Cabinet Office PSN compliance certification. • Obligation to comply with DWP MOU • Monitor remote access usage to capacity plan • Recorded attempts from unauthorised sources to breach council cyber defences • Recorded cyber related incidents in the Cyber incident log • Quantity of breaches/incidents reported to the Information Commissioners Office • Fines levied for breaches Risk Factors • Potential for attacks out of normal working hours /days • Inappropriate Cyber defences at the perimeter of the council network and NHS interconnect network • Inappropriate delivery of security patches to desktop, network switches and server estates • Compliance with security standards such as PSN, PCI, Public Sector Action Plan on Cyber resilience for Scotland • Continually changing threat landscape • Maintaining relevant skill sets among employee group / cost of securing expert resources • Increased targeted attacks and risks due to Remote working. •Remote access technology may not remain fit for purpose in a Smart working environment Internal Controls Robust backup strategy in place on premise and cloud backup for 365 with immutable capability. • Service Continuity Plans • ICT Disaster Recovery Plan • Continually review and update internal policies on patching and system hardening to ensure we keep abreast of emerging threats and trends • Annual PSN compliance audit including a comprehensive IT Health Check • Governance structure in place, ICT Steering Board consisting of senior management and relevant stakeholders meeting bi-monthly or as required in response to incidents/events • Programme of Internal and External ICT audits • Information Security/Data Protection forum. Project specific forums • Multiple layers of Cyber defences • Network Segregation • Rolling programme of security awareness sessions • Interagency and cross Council working groups and sharing. • National Digital Office / Scottish Government Public Sector Security programme and guidance • Continually review technologies in line with new working practices to ensure security and assurance is integral. • Monthly device and server patching regime.
Page 10
10 Official Latest Note This risk will always be high as the threat and likelihood of a Cyber Attack remains. The UK public sector is still experiencing elevated levels of targeted Cyber-attacks including recent attacks on Scottish councils. As this risk continues to be high the emphasis remains on proactive measures to protect the confidentiality, integrity and availability of our data, critical infrastructure, and overall business operations. Key risks and continual threats include: • Geopolitical threat increasing due to current world tensions. Russia is recognised by national security operations as the world’s largest cyber threat actor. • Demand for emerging technologies such as Artificial Intelligence solutions present new challenges for the council to implement and secure. • Risk to Backup technology and corruption of council data. • Ransomware attacks – surge in recent years, potential for significant financial loss and operational disruption. • Advanced Persistent Threats (APT’s) – sophisticated stealthy attacks conducted by well-resourced groups, targets include critical infrastructure, government bodies and large corporations. • User awareness – Phishing attempts on the rise with more sophisticated techniques being deployed including voice and text phishing. Targeted threats tailored to specific areas of the Council are being observed. Social Engineering and ‘old school’ cyber-attacks now present a higher risk. • Third Party Risks – The Council often relies on third party vendors and suppliers, increasing the risk of cyber-attacks through the supply chain. Mitigations: • Implementation of a new Cyber Incident Logging and Response system (MDR) offering enhanced protection. • Continual improvement of our vulnerability/patch management systems and processes. • Continual promotion of Cyber awareness through simulated phishing campaigns supported by our online security training and awareness platform. • Social Engineering guidance issued to all employees with new ‘Be Cyber Smart’ campaign. • Engagement with ICT Security Partners to highlight and advise on specific areas of risk. • Continual assessment and improvement of our Cyber Security posture. • Robust Business Continuity and Disaster Recovery plans with a new ICT backup policy in place. Progress continues to take place to improve our security posture in line with the national Public Sector Action plan (PSAP) and Public Sector Network (PSN) compliance. Vigilance of the National Cyber Security Centre (NCSC) Cyber Security and Scottish Government (SC3) guidance continues to remain in place. Risk Opportunity • Increase Cyber resilience and awareness for employees, members and citizens, this can be done through existing training and awareness platform • Contribute to Scottish Government Public Sector Action Plan on Cyber resilience for Scotland and potential to become involved in a national/shared security operations centre • Upskill employees to address current and emerging threats • Increased employee awareness across Council and partners HSCP, VJB and WDL. Linked Actions Code & Title Progress Status Assigned To P&T/26-27/ICT/01 Further secure the next phase of the Council’s technology infrastructure Andrew Cameron; James Gallacher P&T/26-27/ICT/04 Complete review of devices due to be replaced James Gallacher; Dorothy Nicolson P&T/26-27/ICT/05 Review and explore next generation technologies,including AI agents James Gallacher P&T/25-26/ICT/01 Further secure the next phase of the Council’s technology infrastructure Andrew Cameron; James Gallacher; Patricia Kerr P&T/25-26/ICT/04 Complete review of ICT devices due to be replaced James Gallacher; Patricia Kerr; Dorothy Nicolson P&T/25-26/ICT/05 Review and explore next generation technologies Andrew Cameron; James Gallacher; Patricia Kerr; Dorothy Nicolson
Page 11
11 Official SR 09 Challenges in delivering effective services in relation to Roads & Neighbourhoods The risk that the Council’s fails to deliver on the three service areas within Roads & Neighbourhood: Roads & Transportation, Waste & Greenspace and Fleet & Working 4 You. These areas provide services across a range of areas including managing and maintaining roads, footpaths and associated infrastructure, managing flood risk, winter gritting, grounds maintenance, street cleaning, burial and cremation, outdoor facilities, waste and recycling, vehicle fleet management and providing working 4 you services such as employability, child poverty plan, access to benefits etc. Failing to ensure these services are not fully fit for purpose could result in adverse consequences in relation to delivering efficient and effective services. Current Risk Matrix Last Review Date Current Rating Target Risk Matrix Target Date Target Rating Assigned To 05-Jan- 2026 4 31-Mar-2027 2 Gail Macfarlane Potential Effect - Service cannot be properly delivered to the satisfaction of service users - Service users seek alternative service provision -Increase in reactive maintenance costs/ demand/ volume - Failure of assets and non delivery of services ie crematorium, fleet vehicles, street lighting -Council assets in poor conditions -Council assets fail to meet relevant standards - Council projects are not delivered on time or on budget -Failure to comply with Transport (Scotland) Act 2019 -Failure to comply with Waste (Scotland) Regulations 2012 - Assets not fit for future and investment not sufficient to fulfil capital investment needs. - Failure to comply with Good Operator License requirements. - Increased reliance on hire vehicles should fleet investment not be adequate. Measures of Impact - Condition surveys - Defect inspection and management - Suitability surveys - Road Condition SPI - Tree Condition surveys -Customer perceptions of service delivery - Investment levels in Assets ie Road Network, Street Lighting Columns, Fleet Vehicles, Crematorium -Asset user satisfaction -Operating costs and savings -Local Government Benchmarking Framework (LGBF) -Association for Public Service Excellence (APSE) -Waste Managers Network Group - Child Poverty Annual Monitoring Report Risk Factors -Adequacy of funding available to improve assets ie parks, road network, fleet - Adequacy of funding to maintain asset base ie roads at a steady state - Adequacy of staff resources allocated to the area ie winter gritting, safety repairs -Over one third of the road network is in need of repair and the current long term capital funding only sustains a steady state condition of the road network - Increased public liability claims due to poor condition of roads network - Increase public liability claims due to poor condition of footpaths and roads which are not part of our adopted network. -Risk of flooding increase due to climate change - Risk of failure of street lighting columns due to significant number outwith 25 year life span - Adequacy of funding available to manage ash dieback -Poor customer engagement for recycling, deposit return scheme, refuse transfer station -Financial challenges - Budget Sensitivity Analysis (fuel costs, waste refuse disposal tonnage costs, bitumen availability and costs) Internal Controls -Strategic Asset Management Group - Corporate Asset Management Strategy - Capital project meetings are carried out monthly in addition to project specific meetings. - Capital plan - Roads and Lighting Asset Implementation Plan - Fleet Asset Implementation - Open Space Asset Implementation Plan
Page 12
12 Official - Sustainability Policy - Waste Strategy and Project Board - Net Zero Cooperation Agreement Project Board -User feedback – complaints data, Citizens’ Panel -Climate Change Strategy -Community Empowerment Strategy -Food Growing Strategy and Allotments -Equality Outcomes Latest Note No change to current scoring. Monitoring and action plans in place to manage risk. Risk Opportunity -Enhance reputation of Council -Ensure services are fit for the future and are compliant with legislation changes -Assets and service delivery (e.g. roads upgrade programme, vehicle replacement programme, greenspace upgrade projects) - Secure external funding for development of projects inc flooding, sustainable travel, net zero and public realm improvements - The continued implementation of the net zero cooperation agreement will maximise the opportunity to reduce costs and carbon use. Linked Actions Code & Title Progress Status Assigned To R&N/25-26/GS/04 Develop a new local biodiversity action plan Ian Bain R&N/26-27/GS/05 Remove trees affected by Ash Die Back- phase two of plan Ian Bain R&N/26-27/R&T/02 Progress phased delivery of public electric charging points Liam Greene R&N/26-27/R&T/03 Progress preparatory work for Gruggies Burn Flood Management with contractor Liam Greene R&N/26-27/WFU/04 Compile and publish the local child poverty report to demonstrate our actions to address poverty and disadvantage Stephen Brooks; Clare English; Clare Henry R&N/25-26/GS/05 Develop ash die back action plan – next phase Ian Bain R&N/25-26/R&T/06 Progress phased delivery of public and fleet electric charging points – next phase Liam Greene R&N/25-26/R&T/10 Develop new Roads and Transport Winter Plan for consideration at May Committee Liam Greene SR 10 Failure to maintain Housing Stock The risk that Council’s Housing Stock are not fully fit for purpose with consequent adverse impact on our ability to deliver efficient and effective housing for Council tenants. Current Risk Matrix Last Review Date Current Rating Target Risk Matrix Target Date Target Rating Assigned To 14-Jul- 2026 4 31-Mar-2027 4 Alan Young Potential Effect - Housing stock is not utilised in the most effective and efficient manner - Service cannot be properly delivered to the satisfaction of service users -Increase in reactive maintenance costs/ demand/ volume -Housing stock in poor condition -Housing stock fail to meet relevant standards - Non-compliance with Scottish Housing Quality Standard Measures of Impact - Condition surveys - Suitability surveys - Customer perceptions of service delivery - Investment levels in upkeep and improvement of housing stock -User satisfaction -Operating costs and savings - Local Government Benchmarking Framework (LGBF)
Page 13
13 Official Risk Factors - Adequacy of funding available to improve housing stock - Adequacy of staff resources allocated to the management of housing stock - Housing stock deemed to be unfit for existing purpose -Increasing issues relating to supply of labour and materials, due to increased energy, transport and raw material costs, impacted on supply chains, and third parties and our ability to carry out works within budget and on time. Internal Controls - Housing Capital Investment Programme (refreshed and delivered annually) - Housing Capital Improvements - WDC Local Housing Strategy 2021-25 - The Housing Capital Investment Team - The Planned Maintenance Section - Housing Asset Management Strategy - Detailed asset database that shows relevant information on a property by property basis in relation to HRA properties. - More Homes Better Home Project Board. - Telephone Survey feedback - Fit for future reviews -Other benchmarking/ feedback - Climate Change Strategy Latest Note No change to risk score, programme for investment and upgrades to council housing continues into 26-27 and a further five year programme to 26-31. Risk Opportunity -Enhance reputation of Council by being able to improve Council housing stock -Estate, assets and service delivery (housing investment programme ) -Improved satisfaction from tenants - The effect of these energy efficiencies has demonstrated that significant savings and environmental benefit can be achieved through the utilisation of developing technology. -Improvement of SHQS & EESSH compliance performance and points, and reduced SHQS abeyance numbers through the strategic planning and management of housing assets. - Increase in environmental improvements including bin stores - Increase in internal (e.g kitchens, bathrooms, showers, special needs adaptations, central heating, smoke detectors, windows and doors) and external updates (e.g new roof coverings, external insulated render and tenement structural refurbishments) - Increase in number of New Build Homes as part of the Strategic Housing Investment Programme (SHIP) -Achieve energy efficiency standard for social housing Linked Actions Code & Title Progress Status Assigned To HS/26-27/HAI/01 Ensure the Council’s Housing stock maintains compliance with the Scottish Housing Quality Standard and reduce the number of properties held in abeyance. Alan Young HS/26-27/HAI/02 Ensure the Council’s Housing stock progresses towards the achievement of the energy efficiency standard for social housing. Alan Young HS/26-27/HAI/03 Explore opportunity for partnership working with Octopus energy to promote zero bills homes Alan Young SR 11 Inability to reduce carbon footprint in line with targets The risk that the Council will be unable to achieve net zero emissions by 2045, both in relation to mitigating carbon emissions and adapting to the impacts of climate change. Net zero refers to achieving an overall balance between emissions produced and emissions taken out of the atmosphere. This target has been developed in a way that mirrors the emission reduction trajectory set by the Scottish Government in light of the Climate Emergency. Current Risk Matrix Last Review Date Current Rating Target Risk Matrix Target Date Target Rating Assigned To 27-Jul- 2026 9 31-Mar-2027 2 Alan Douglas; Amanda Kean; Gail Macfarlane Potential Effect Failure to meet mandatory national and international policy drivers Failure to meet duties placed on Council by The Climate Change (Scotland) Act 2009 Failure to meet duties placed on Council by The Climate Change (Emissions Reduction Targets) (Scotland) Act 2019
Page 14
14 Official Failure to meet duties placed on the Council by The Heat Networks (Scotland) Act 2021 and Local Heat and Energy Efficiency Strategies (Scotland) Order 2022. Failure to meet the provisions set out in Waste (Scotland) Regulations 2012 which help Scotland move toward the objectives and targets set out in the Scotland’s Zero Waste Plan to help transition toward a circular economy. Reputational damage. Financial burden of responding to adverse events such as extreme weather (including, but not limited to, flooding, heat waves, wind driven storm events, etc.) resulting in action. Impacts to Council operations and supply chains as a result of adverse climate/extreme weather events. This also impacts residents, local businesses and wider infrastructure across West Dunbartonshire. Financial burden on WDC from increasing energy prices in light of current energy and economic crises’. Energy Efficiency works on our own estate must increase to counteract these impacts. Measures of Impact Improving organisational resilience against the impacts of climate change. Improving local biodiversity through planting of native trees and bulbs in WDC WDC Waste Services Citizens Panel Survey regarding attitudes towards recycling improving The extension of the Queens Quay District Heating Network to NHS Golden Jubilee Hospital, Social Housing, NHS Health Centre, Council buildings and further connections as per scope. Inspiring change through including climate change learning in staff induction, training, team meetings, etc. Uptake in e-learning modules on climate change. Uptake in staff carrying out Sustainable Procurement assessments for tenders. Ensuring climate change and sustainability metrics are included in tenders for suppliers/contractors/etc. (such as carbon reduction measures) so they are being measured for accountability for the impacts they have on the environment Management of service areas setting climate change targets for their operations and staff. The uptake of Green Champion roles, which help normalise Climate Change and Sustainability, practices across the Council. Uptake in sustainable travel such as walking cycling and public transport Risk Factors Funding availability – delivery of actions to mitigate will require resources, capital works and investment by the Council- e.g enhanced energy measures, and heating and renewables projects in both domestic and non-domestic building assets Budget stress – notably due to energy and economic crisis, meaning it’s more difficult for Council to set aside budget to deliver on Climate Change and Net Zero projects and actions. Funding approach – a combination of internal and external funding sources will be need to delivery climate action at scale. Short term funding mechanisms such as annual payback of Council expenditure presents difficulties for delivering long-term projects. Climate Change investments also need to take account of whole-life costs including reduced maintenance costs and avoided Adaptation costs. Internal capacity – limited staff time and availability, largely due to reduced Council budgets, further impacted by Covid19. Communication – both internally (to avoid ‘silo’ working) and externally (engaging with the public and keeping abreast of local/national/international changes to policy). Economics – some technologies, materials and skills are still very expensive so innovation must progress to enhance the viability of climate actions within the context of the Council’s budget constraints. Strategy and planning – all existing and future Council plans should place responding to the climate emergency at their core and ensure integration with other Council services. Legislation & Regulatory – the ability to implement some climate actions is constrained at the local level by minimum standards and other restrictions set through legislation and national policy, for example in relation to building regulations, planning and procurement. Public attitudes and behaviours - Changing behaviour of residents, businesses and stakeholders positively and proactively, especially where there are cost implications to the delivery of climate actions. Internal Controls . Climate Change Strategy 2021-2026 . Action Plan 2021-2026 . Climate Change Action Group (CCAG) . Pentana Risk Management System – devolved responsibilities of climate change actions/milestones/KPI’s to service areas. . Scottish Government – Mandatory annual Climate Change Duties Reporting . Queens Quay District Heating Network . Strategic Environment Assessment (SEA) . Air quality monitoring . Converting some Council pool fleet to Electric Vehicles (EVs). . Climate Ready Clyde (CRC) – a cross-sector initiative funded by fifteen member organisations and supported by the SG. Delivery of a Locale Heat & Energy Efficiency Strategy (LHEES) and delivery plan by December 2023 – which sets out the Council’s area-based approach to reducing emissions of heating and energy efficiency improvements to ALL assets across WD. This includes private housing, businesses, etc. which are not owned/operated by WDC. . Waste infrastructure and greatly improving approach to how Council and residents reduce, reuse and recycle waste. Notably, taking a Circular Economy approach to waste services and implementing appropriate infrastructure and contracts to do so. Latest Note The risk assessment remains unchanged from mid-year.
Page 15
15 Official The Council's most recent emissions reported in November for 2024/25 showed significant progress. (Details are set out under the PI ‘Tonnage of carbon dioxide emissions from Council operations and assets’ above.) The long-term Climate Change Coordinator vacancy has been filled internally; this currently leaves another vacancy within the energy team that will be filled as soon as possible. Participation from service areas has increased at Climate Change Action Plan meetings and emission reductions actions and projects are forthcoming. The Council also has the opportunity to utilise ClimateView and track trajectory to Net Zero, allowing actions and projects to be prioritised and a more collective, strategic approach to be implemented. The Strategic Risk will be reviewed at the next Climate Change Action Plan meeting for relevance and an amended risk / set of risks will be reported to future meetings. Risk Opportunity Our local environment is protected, enhanced and valued rOur residents feels pride in their local neighbourhood The percentage of household waste sent for reuse, recycling and composting has increased resulting in reduction in the percentage that was being landfilled. The percentage of council land which promotes diversity of habitat and species has increased Our resources are used in an environmentally sustainable way Increase in the percentage of businesses taking action to reduce their carbon impact Reduction in CO2 emissions under the Council’s influence Reduction in West Dunbartonshire Area-Wide emissions as per requirements of the climate change (Scotland) act Residents actively involved in tackling climate change and protecting the environment The economy and infrastructure become more low carbon and environmentally-friendly Our neighbourhoods are sustainable and attractive Increased investment in our housing stock including improving energy efficiency Housing developments are meeting the needs of our changing population The quality of neighbourhoods has improved Our roads and transport network are maintained and they promote safe travel routes Linked Actions Code & Title Progress Status Assigned To R&R/25-26/025 Develop the Local Heat and Energy Efficiency Strategy Delivery Plan Amanda Kean; Elaine Troup R&R/26-27/021 Complete the Local Heat and Energy Efficiency Delivery Plan for implementation Amanda Kean R&R/25-26/024 Co-ordinate, monitor and report the progress of the Council’s Climate Change Action Plan for 2025/26 Amanda Kean; Elaine Troup SR 12 National Power Outage (NETS Failure) There is a risk that a sustained or widespread national power outage results in a loss of electricity across West Dunbartonshire, leading to major disruption of council services, ICT systems, communications, care provision, and critical infrastructure. This may result in risks to vulnerable residents, employee safety, service continuity, statutory compliance, and reputational damage. Current Risk Matrix Last Review Date Current Rating Target Risk Matrix Target Date Target Rating Assigned To 31-Jul- 2026 8 31-Mar-2027 4 Victoria Rogers Potential Effect A loss of electricity across West Dunbartonshire would lead to major disruption of council services. Impacts would be felt on ICT systems, council communications both internally and externally, care provision to residents, and critical infrastructure. This may result in an increased risk to vulnerable residents, employee's safety, service continuity, statutory compliance, and reputational damage. Measures of Impact - Inability to deliver essential services (care at home, social care, waste, housing support) - ICT and data system outages (telecommunications, data networks, email, telephony, business applications, case management)
Page 16
16 Official - Reputational damage and loss of public confidence - Loss of digital payments and access to online services - Disruption to emergency response and multi‑agency coordination - Employee welfare issues (health, safety, lone working) - Reduced ability to deliver essential and statutory services - Increased risk to vulnerable residents reliant on powered medical or care equipment Risk Factors - An increased number in instances of extreme weather caused by climate change - Damage to power grid infrastructure (accidental or intentional) - Failure in power grid infrastructure due to lack of maintenance or failure in maintenance processes - Failure to have appropriate Business Continuity Planning in place to ensure provision of council services during a power outage - lack of co-ordination with neighbouring local authorities and national organisations on steps to be taken during a power outage - Lack of employee knowledge on council and HSCP Business Continuity Plans with a specific focus on steps to be taken during a power outage - The only council asset currently equipped with a secondary power system (generator) which could be deployed during a power outage is the Data Centre - Cyber or hostile state attack on power grid infrastructure - No charging facilities for EV fleet - Increase to life risk of vulnerable residents within WDC premises due to lack of secondary power systems within high-risk buildings (care homes etc.) - Loss of staff which will impact upon service delivery. Internal Controls - Council and HSCP Business Continuity Plans covering NETS failure and loss of utilities - Identification and prioritisation of Essential Services - ICT Disaster Recovery and Cyber Incident Response Plans - Pre‑identified fallback locations - Cross‑service power resilience planning and assurance checklists - Multi‑agency emergency planning via Local Resilience Partnership - Established resilient communications, including Raynet antenna installations in WD area, now covering all authorities under the CCS umbrella - Employee awareness through business continuity and emergency planning guidance Latest Note 4/8/26- further work required at Church St to extend Raynet coverage (fully funded by CCS); work ongoing to complete BCP for all services with senior leadership awareness sessions and power resilience exercise delivered in 2026 Risk Opportunity - Risk reviewed through Corporate Risk Register and Service Risk Registers - Progress monitored via Business Continuity assurance checks - Lessons learned captured following exercises or incidents - Reported through appropriate governance and resilience forums Linked Actions Code & Title Progress Status Assigned To SR 12/001 Finalise and maintain a Council wide list of Essential Services and priorities Scott Mcfarlane SR 12/002 Define offline working arrangements for critical services in business continuity plans James Gallacher SR 12/003 Extend testing of Raynet and alternative communications arrangements Scott Mcfarlane SR 12/004 Deliver annual NETS failure exercises Scott Mcfarlane SR 12/005 Communications plan for public messaging during power outage Lauren Crooks SR 12/006 Employee welfare plan including redeployment, transport, and safety measures Louise Hastings SR 12/007 Continue annual review of business continuity plans to ensure relevance Scott Mcfarlane Risk Status Alert High Risk Warning
Page 17
17 Official OK Unknown
Page 18
No embedded text on this page.