Item 8 - Strategic Risk Report 2023
West Dunbartonshire Council · 15 February 2023
Back to Audit Committee — 15 February 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
WEST DUNBARTONSHIRE COUNCIL Report by Chief Officer – People & Technology Audit Committee: 15 February 2023 ___________________________________________________________________ Subject: Strategic Risks 2022-2027 1. Purpose 1.1 To provide an update on the strategic risks for 2022-27. 2. Recommendations 2.1 It is recommended that the Committee note: • The strategic risks as detailed at Appendix 1. 3. Background 3.1 The Council’s 2022 – 2027 strategic risks were agreed by the Corporate Services and Audit Committees in November 2022. The appended risks have been reviewed with re-assessment undertaken before being reported to this committee. This report is submitted as agreed to Corporate Services and Audit Committees on a bi-annual basis (noting that this report is remitted now to revert to the bi-annual cycle). 4. Main Issues Strategic Risk 4.1 In line with the Council’s Risk Management Framework, a re-assessment of the Strategic Risks has taken place as detailed within Appendix 1. Each risk is managed through internal controls, linked actions and associated milestones with the objective being to reduce or stabilise the level of risk through completion of linked actions over a period of time and/or ensure mitigation factors are adequate should the risks actually materialise. 4.2 Table 1 represents a risk dashboard that includes information on the original, current and target rating for each strategic risk, as well as an assessment of the current risk status. Each strategic risk is identified and supported by more detailed information available on a “drill-down” basis in Appendix 1. Two strategic risks, associated actions and milestones are met, a further seven are progressing as expected and closer to reaching their assigned targets and SR001 and SR008 are currently off-target and this is explained in further detail below. Supplementary information on SR002 is also provided. ITEM 8
Page 2
Table 1 Key Strategic Risk Information Strategic Risk Original Risk Oct 2022 Current Risk Dec 2022 Target Risk 2027 Risk Status Rationale SR 001 Significant financial funding reductions/limitations from Scottish Government SR 002 Challenges in implementing broad- ranging school improvement to raise attainment and achievement SR 003 Maintaining Council Assets that are fit for purpose SR 004 Keeping abreast of developments in the innovative use of Information Technologies SR 005 Engaging positively with Residents, Communities & Partnerships SR 006 Challenges in protecting the Health and Safety of Employees and Others SR 007 Complexities in ensuring an appropriately resourced and resilient workforce
Page 3
Risk Methodology and Reporting 4.3 Each strategic risk is populated in Pentana in terms of the following template: • Risk title and code; • Description; • Ownership; • Potential effect; • Measures of impact; • Risk factors; • Internal controls; • Risk opportunity; and • Linked actions. 4.4 Each risk has been scored using a “4 x 4” matrix for likelihood and impact in relation to: • Current risk (with review dates set at pre-determined intervals); and • Target risk (i.e. 31 March 2027 - the duration of the Strategic Plan). The risk descriptors used in the “4 x 4” matrix are as follows: SR 008 Threat of Cyber Attack SR 009 Challenges in delivering effective services in relation to Roads & Neighbourhoods SR 010 Failure to maintain Housing Stock SR 011 Inability to reduce carbon footprint in line with targets
Page 4
Likelihood Score Descriptor 1 Unlikely 2 Likely 3 Very likely 4 Certain Impact Score Descriptor 1 Minor 2 Moderate 3 Significant 4 Critical 4.5 For ownership, each strategic risk is “Managed By” a Chief Officer and “Assigned To” a Senior Officer. Strategic risks are also reported on a bi- annual basis to the Performance & Monitoring Review Group. Service Risk 4.6 Following the methodology in 4.3 to 4.4 above, each service has owned operational risk registers in Pentana (the Council’s performance system); these will be reviewed as part of the 2023/24 service planning process. 4.7 Significant financial funding reductions/limitations from Scottish Government SR001 is currently off target and is currently scored as twelve compared to a target rating of four. Whilst the target rating is desirable the Council is limited in its influence over the likelihood of it crystallising. Whilst the Scottish Government is lobbied by COSLA for fairer funding for Local Government, which includes contributions from the Council Leader, Chief Executive supported by information provided by the Council’s Chief Officer Resources (S95 Officer) ultimately decisions over levels of local government funding are made by the Scottish Government. The likelihood of this risk is not expected to decrease in the medium term future with assumptions over future funding levels incorporated into projected budget gaps as reported in Financial Update reports presented to Council. 4.8 Threat of Cyber Attack SR008 is currently off target due to a number of factors. The cyber threat continues to increase with ransomware being the biggest threat even during this period of Geo-political instability. Work has been undertaken to continue securing the Confidentiality, Integrity and Availability of our data and has resulted in the implementation of new technologies such as remote updating of devices, network scanning, secure remote control of employee devices and the replacement of ageing security hardware. In addition, a new secure
Page 5
process for remote control of employee devices have also been implemented to address some of the security challenges from emerging threats. New ways of working, including increased remote access users, robotic process automations, digital transformations and adoption of cloud based technologies all have an impact on the risk profile of the organisation and ICT continue to work with service areas to reduce and mitigate emerging risks. Lack of user awareness within organisations still remains one of the biggest Cyber Security threats, with a visible increase in Voice Phishing attempts being seen throughout the organisation, Bank Mandate fraud attempts have also significantly increased with several attempts to change bank details for employees being observed. To combat this we have resumed physical training events to Elected Members, the Joint Consultative Forum and senior management within the Council. Face to face cyber security training combined with DPA and fraud awareness sessions has also resumed and these have been well attended. We have invested in an online Security Training Platform which will provide additional security awareness training and allow us to run Phishing campaigns for our staff, delivering short, brief awareness videos where they are most required. We are taking steps to reduce the amount of information that is publicly available about our systems, policies and processes by restricting specific areas of the employee Intranet site to a secure login. ICT are reviewing the structure and resources of the security team to ensure capacity and resilience is built in. In addition, ICT employees are attending industry standard security training to assist in managing the threat of Cyber Risk to WDC. Work continues to take place to improve our security posture in line with the national Public Sector Action plan (PSAP) and Public Sector Network (PSN) compliance. Vigilance of the National Cyber Security Centre (NCSC) Cyber Security guidance continues to remain in place in light of any changes regarding the geopolitical instability in Ukraine and the surrounding areas. 4.9 Challenges in implementing broad-ranging school improvement to raise attainment and achievement SR002 has reduced the risk rating since last reported. The pandemic affected national and local outcomes in education attainment and equity due to periods of school/ ELC closure; absence due to Covid and shielding. The risk reporting period ended on 31st March 2022 and The Education Service had a recovery strategy for attainment in place. This needed a full academic year (August 2021 to June 2022) to have an impact on attainment although employee and pupil absences due to Covid were still being experienced. However, in academic session 2021/22, a narrowing of the attainment gap and increase in attainment was achieved in the attainment levels in the Broad General Education at primary level. A robust improvement and recovery model is in place to build on the progress made in academic session 2021/ 22. As the challenge of Covid absence is lessened this session then further improvement gains are predicted for academic session 2022/2023. The Education Committee is provided with regular update reports on progress with
Page 6
the strategy to raise attainment and achievement and also the national agencies monitor and report on local attainment performance. 5. People Implications 5.1 There are no people implications associated with this report, other than in relation to the mitigation of risks 6. Financial and Procurement Implications 6.1 There are no financial and/or procurement implications directly associated with this report however there are in relation to any expenditure linked to mitigation. 7. Risk Analysis 7.1 Failure to ensure robust risk management is likely to result in the Council being criticised by External Auditors for not having an integrated approach to embedding risk management within the authority with the result that a “no scrutiny required” status would not be achieved. 7.2 Progressing with a robust risk management approach will demonstrate that the Council is taking ownership of risk management and ensuring effective measures are in place. The ability to demonstrate risk ownership should benefit the Council in terms of: • Understanding risk and its potential impact on the Council’s priorities and objectives; • Reducing insurance premiums going forward by recognising that a mature approach to risk management will contribute to a reduction in the number and value of claims across a range of insurance classifications; • Contributing towards incident prevention based upon post-incident investigation; • Meeting statutory/regulatory requirements; and Ensuring better partnership working with external and internal partners. 8. Equalities Impact Assessment (EIA) 8.1 EIA 548 notes the positive impacts of an approach to risk that integrates considerations on equalities, human rights health and social and economic impacts that is aligned with the content of the new Strategic Plan. 9. Consultation 9.1 The strategic risks have been discussed with the Chief Officers and senior management. The reports to committee are available to the Trades Union and consultation undertaken as required.
Page 7
10. Strategic Assessment 10.1 At its meeting on 26 October 2022, the Council agreed that its five main strategic priorities for 2022 - 2027 are as follows: • Our Communities - Resilient and Thriving • Our Environment - A Greener Future • Our Economy - Strong and Flourishing • Our Council - Inclusive & Adaptable 10.2 The strategic risks have been identified to complement the main strategic priorities. Name: Victoria Rogers Designation: Chief Officer People & Technology Date: 13 January 2023 Person to Contact: Anna Murray, Risk & Health and Safety Officer Anna.Murray@west-dunbarton.gov.uk Appendices: Appendix 1: Detailed Strategic Risk List Background Papers: West Dunbartonshire Council Strategic Plan 2022-2027 Risk Management Framework EIA screening