Item 5 - Strategic Risks 2022-27
West Dunbartonshire Council · 9 November 2022
Back to Audit Committee — 9 November 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
WEST DUNBARTONSHIRE COUNCIL Report by Chief Officer – People & Technology Audit Committee: 9 November 2022 ___________________________________________________________________ Subject: Strategic Risks 2022-2027 1. Purpose 1.1 To set out proposed changes to the strategic risks for 2022-2027 following the Strategic Plan developments. 2. Recommendations 2.1 It is recommended that the Committee agree: • The strategic risks as detailed at Appendix 1 3. Background 3.1 The Council’s 2017 – 2022 Strategic Risks came to a natural end on 31st March 2022. Following a review, new risks have been developed, as well as revisions to existing and proposed deletions of those no longer required. Table 1 includes details of risks to be carried forward into the next five year plan and those that are being retired. Table 2 includes details of the full suite of Strategic Risks proposed for 2022-2027. 3.2 The appended risks have been fully reviewed and re-assessment will be undertaken bi-annually before being reported to this committee. This report will also be submitted as agreed to the Corporate Services Committee on a bi- annual basis. 4. Main Issues Strategic Risk 4.1 In line with the Council’s Risk Management Framework, an assessment of the Strategic Risks has taken place as detailed within Appendix 1. Each risk is managed through internal controls, linked actions and associated milestones with the objective being to reduce or stabilise the level of risk through completion of linked actions over a period of time and / or ensure mitigation factors are adequate should the risks actually materialise. 4.2 Table 1 represents a risk dashboard that includes information on the 2017-22 Strategic Risks. This gives information on the original risk rating, risk rating at ITEM 5
Page 2
completion of the Strategic Plan 31st March 2022 and the target rating. This will also highlight those risks that have been retired and won’t be carried forward into the 2022-2027 Strategic Plan. Four Strategic Risks met their target, a further four progressed and were close to reaching their assigned targets. Four risks were off target and unlikely to reach their intended outcome. Table 1 Key Strategic Risk Information 2017 -2022 Strategic Risk Original Risk 2017 *2020 for SR012 Pandemic Risk on 31st March 2022 Target Risk 2022 Recommendation for 2022-27 SR 001 Significant financial funding reductions / limitations from Scottish Government Continue SR 002 School improvements. Continue SR 003 Council Assets. Continue but split into 3 SR 004 Information Technology. Continue SR 005 Partnerships. Continue but combine with SR006 SR 006 Citizens and Communities. As above SR 007 Health and Safety of Employees and Others Continue
Page 3
Table 2 Table 2 represents a risk dashboard that includes information on the new 2022-27 Strategic Risks. This gives information on the current rating and target rating. SR 008 Cyber Attack. Continue SR 009 Early Years Agenda. Retire SR 010 Resourced Workforce. Continue SR 011 EU Exit Retire SR 012 Pandemic (COVID) Retire Strategic Risk Current Risk 2022 Target Risk 2027 Risk Status SR 001 Significant financial funding reductions / limitations from Scottish Government SR 002 Challenges in implementing broad- ranging school improvement to raise attainment and achievement SR 003 Maintaining Council Assets that are fit for purpose
Page 4
SR 004 Keeping abreast of developments in the innovative use of Information Technologies SR 005 Engaging positively with Residents, Communities & Partnerships SR 006 Challenges in protecting the Health and Safety of Employees and Others SR 007 Complexities in ensuring an appropriately resourced and resilient workforce SR 008 Threat of Cyber Attack SR 009 Challenges in delivering effective services in relation to Roads & Neighbourhoods SR 010 Failure to maintain Housing Stock SR 011 Inability to reduce carbon footprint in line with targets
Page 5
Risk Methodology and Reporting 4.3 Each strategic risk is populated in Pentana in terms of the following template: • Risk title and code; • Description; • Ownership; • Potential effect; • Measures of impact; • Risk factors; • Internal controls; • Risk opportunity; and • Linked actions. 4.4 Each risk has been scored using a “4 x 4” matrix for likelihood and impact in relation to: • Current risk (with review dates set at pre-determined intervals); and • Target risk (i.e. 31 March 2027 - the duration of the Strategic Plan). The risk descriptors used in the “4 x 4” matrix are as follows: Likelihood Score Descriptor 1 Unlikely 2 Likely 3 Very likely 4 Certain Impact Score Descriptor 1 Minor 2 Moderate 3 Significant 4 Critical 4.5 For ownership, each strategic risk is “Managed By” a Chief Officer and “Assigned To” a Senior Officer. Strategic risks are also reported on a bi- annual basis to the Performance & Monitoring Review Group. Service Risk 4.6 Following the methodology in 4.3 to 4.4 above, each service has service owned operational risk registers in Pentana; these will be fully reviewed through the 2022/23 service planning process alongside development of the Council’s next five year strategic plan.
Page 6
4.7 Failure to implement broad-ranging school improvement to raise attainment and achievement SR002 SR002 did not reach its intended outcome due to the pandemic period. The pandemic affected national and local outcomes in education attainment and equity due to periods of school/ ELC closure; absence due to Covid and shielding. The risk reporting period ended on 31st March 2022 and The Education Service had a recovery strategy for attainment in place. This needed a full academic year (August 2021 to June 2022) to have an impact on attainment although employee and pupil absences due to Covid were still being experienced. However, in academic session 2021/22, a narrowing of the attainment gap and increase in attainment was achieved in the attainment levels in the Broad General Education at primary level. 4.8 Threat of Cyber-attack SR008 SR008 did not reach its target rating, due to a number of factors. The cyber threat continues to evolve with Ransomware being the biggest threat even during this period of Geo-political instability. Work has been undertaken to continue securing the Confidentiality, Integrity and Availability of our data and has resulted in procurement and implementation of new technologies such as scanning and remote control for end user device support alongside new processes for contact with end users have also been implemented to address some of the challenges. New ways of working, including increased remote access users, robotic process automations, digital transformations and adoption of Cloud based technologies all have an impact on the risk profile of the organisation and ICT continue to work with service areas to reduce and mitigate emerging risks. Lack of user awareness within organisations still remains one of the biggest Cyber Security threats, with a visible increase in Voice Phishing attempts being seen throughout the organisation. To combat this we have resumed physical training events to Elected Members, the Joint Consultative Forum and senior management within the Council. Face to face cyber security training combined with DPA and fraud awareness sessions has also resumed as part of the OD and change learning offerings, these have been well attended. Work continues to take place to improve our security posture in line with the national Public Sector Action plan (PSAP) and Public Sector Network (PSN) compliance. Vigilance of the National Cyber Security Centre (NCSC) Cyber Security guidance continues to remain in place in light of any changes regarding the geopolitical instability in Ukraine and the surrounding areas’
Page 7
4.9 Retired Risks 4.9.1 SR009 Failure to Deliver the Early Years Agenda, SR011 EU Exit and SR012 Pandemic (Covid) have all been retired. SR 009 is being retired as the entitlement was met in May 2021 and the Council have met the Statutory Consultation requirements but, the quality of Early Learning Centre (ELC) and curriculum delivery of the new model will be closely monitored and supported by the central early years’ team. Outdoor expansion projects at various locations will be completed in the next few months. Additional projects are at various stages of planning/implementation: - Linnvale ELCC planning in place, building warrant and start date required - St Mary’s ELCC Alexandria – planning in place, building warrant and start date required - Christie Park Primary School – plans have been drawn up. - In respect of levels of success, 40 ELC settings (including 11 funded partner providers) have all been evaluated at good and above and meet the national standard criteria. 10 ELC were inspected by the Care Inspectorate between August 2021 and August 2022; evaluative grades awarded were good and above. None of the services were evaluated below the level of good. There is evidence of strong improvement and quality of provision at the 10 ELC in the sample of inspections last session. Published reports provide detailed evidence and answer key questions: How good is our care, play and learning? How good is our setting? How good is our leadership? and How good is our staff team? 4.9.2 SR011 is being retired. The UK has left the EU and although it remains important to acknowledge ongoing uncertainty, the incorporation of impacts is included in core risk frameworks. This allows the impacts of EU Exit to be monitored while increasing the efficiency/ effectiveness of the ongoing overall risk monitoring process. The risks are continuing to be monitored appropriately. If any particular area grows again in the future, the approach will be adapted to fit. The plans will similarly be stood down. 4.9.3 SR012 is being retired. There is no longer any national management of covid- 19. All covid-19 rules and restrictions have been lifted in Scotland. Masks are no longer required (other than in some health care settings), the Health & Safety Executive (HSE) no longer require covid-19 cases to be reported and there is an annual booster programme in place for certain groups. The Council has a resilience plan in place which can be lifted if necessary. The Scottish Government have in place a Covid Recovery Strategy: for a fairer future. The strategy focuses on the efforts required to tackle inequality and disadvantage. It will bolster the actions in the – NHS Recovery Plan, Education Recovery Plan and Justice Recovery Plan. 4.10 Following consultation with risk owners and a review of the proposed Strategic Plan and Priorities 2022-2027, the development of a new risk surrounding the
Page 8
Council’s targets in relation to our Carbon footprint was agreed ‘SR011 Inability to reduce carbon footprint in line with targets’. This target has been developed in a way that mirrors the emission reduction trajectory set by the Scottish Government in light of the Climate Emergency and visibility of our efforts to achieve these targets is important. 4.11 Council Assets has been split into three separate risks: ‘Challenges in delivering effective services in relation to Roads & Neighbourhoods’, ‘Failure to maintain Housing Stock’ and ‘Maintaining Council Assets that are fit for purpose’ This will allow a more focussed analysis of these risks and the mitigations in place to effectively manage them. 5. People Implications 5.1 There are no people implications associated with this report, other than in relation to the mitigation of risks 6. Financial and Procurement Implications 6.1 There are no financial and/or procurement implications directly associated with this report however there are in relation to the expenditure linked to mitigation. 7. Risk Analysis 7.1 Failure to ensure robust risk management is likely to result in the Council being criticised by External Auditors for not having an integrated approach to embedding risk management within the authority with the result that a “no scrutiny required” status would not be achieved. 7.2 Progressing with a robust risk management approach will demonstrate that the Council is taking ownership of risk management and ensuring effective measures are in place. The ability to demonstrate risk ownership should benefit the Council in terms of: • Understanding risk and its potential impact on the Council’s priorities and objectives; • Reducing insurance premiums going forward by recognising that a mature approach to risk management will contribute to a reduction in the number and value of claims across a range of insurance classifications; • Contributing towards incident prevention based upon post-incident investigation; • Meeting statutory/regulatory requirements; and Ensuring better partnership working with external and internal partners. 8. Equalities Impact Assessment (EIA) 8.1 EIA 548 notes the positive impacts of an approach to risk that integrates
Page 9
considerations on equalities, human rights health and social and economic impacts, that is aligned with the content of the new Strategic Plan. 9. Consultation 9.1 The strategic risks have been discussed with the Chief Officers and senior management. The reports to committee are available to the Trades Union and consultation undertaken as required. 10. Strategic Assessment 10.1 The Council will agreed its main strategic priorities for 2022-27 at its meeting on 26 October 2022. Due to timelines this report will be submitted prior to this meeting. However the proposed priorities are: • Our Communities - Resilient and Thriving • Our Environment - A Greener Future • Our Economy - Strong and Flourishing • Our Council - Inclusive & Adaptable 10.2 The strategic risks have been identified to complement the main strategic priorities. Name: Victoria Rogers Designation: Chief Officer People & Technology Date: 7 October 2022 Person to Contact: Anna Murray, Risk & Health and Safety Officer Email Anna.Murray@west-dunbarton.gov.uk Appendices: Appendix 1: Detailed Strategic Risk List Background Papers: Dunbartonshire Council Strategic Plan DRAFT 2022- 2027 (once available) Risk Management Framework EIA screening