Item 7 - Strategic Risks 2022-2027
West Dunbartonshire Council · 21 February 2024
Back to Audit Committee — 21 February 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
WEST DUNBARTONSHIRE COUNCIL Report by Chief Officer – People & Technology Audit Committee: 21 February 2024 ___________________________________________________________________ Subject: Strategic Risks 2022-2027 1. Purpose 1.1 To provide an update on the strategic risks for 2022-27. 2. Recommendations 2.1 It is recommended that the Committee note: • The strategic risks as detailed at Appendix 1. 3. Background 3.1 The Council’s 2022 – 2027 strategic risks were agreed by the Corporate Services and Audit Committees in November 2022. The appended risks have been reviewed with re-assessment undertaken before being reported to this committee. This report is submitted as agreed to Audit Committee on a bi- annual basis. 4. Main Issues Strategic Risk 4.1 In line with the Council’s Risk Management Framework, a re-assessment of the Strategic Risks has taken place as detailed within Appendix 1. Each risk is managed through internal controls, linked actions and associated milestones with the objective being to reduce or stabilise the level of risk through completion of linked actions over a period and/or ensure mitigation factors are adequate should the risks actually materialise. 4.2 Table 1 represents a risk dashboard that includes information on the original, current and target rating for each strategic risk, as well as an assessment of the current risk status. Each strategic risk is identified and supported by more detailed information available on a “drill-down” basis in Appendix 1. Four strategic risks, associated actions and milestones are met, a further three are progressing as expected and closer to reaching their assigned targets and SR001, SR007, SR008, and SR011 are currently off target, which is explained in further detail below. Item 7
Page 2
Table 1 Key Strategic Risk Information Strategic Risk Original Risk Oct 2022 Current Risk Jan 2024 Target Risk 2027 Risk Status Rationale SR 001 Significant financial funding reductions/limitations from Scottish Government SR 002 Challenges in implementing broad- ranging school improvement to raise attainment and achievement SR 003 Maintaining Council Assets that are fit for purpose SR 004 Keeping abreast of developments in the innovative use of Information Technologies SR 005 Engaging positively with Residents, Communities & Partnerships SR 006 Challenges in protecting the Health and Safety of Employees and Others SR 007 Complexities in ensuring an appropriately resourced and resilient workforce
Page 3
Risk Methodology and Reporting 4.3 Each strategic risk is populated in Pentana in terms of the following template: • Risk title and code; • Description; • Ownership; • Potential effect; • Measures of impact; • Risk factors; • Internal controls; • Risk opportunity; and • Linked actions. 4.4 Each risk has been scored using a “4 x 4” matrix for likelihood and impact in relation to: • Current risk (with review dates set at pre-determined intervals); and • Target risk (i.e. 31 March 2027 - the duration of the Strategic Plan). The risk descriptors used in the “4 x 4” matrix are as follows: SR 008 Threat of Cyber Attack SR 009 Challenges in delivering effective services in relation to Roads & Neighbourhoods SR 010 Failure to maintain Housing Stock SR 011 Inability to reduce carbon footprint in line with targets
Page 4
Likelihood Score Descriptor 1 Unlikely 2 Likely 3 Very likely 4 Certain Impact Score Descriptor 1 Minor 2 Moderate 3 Significant 4 Critical 4.5 For ownership, each strategic risk is “Managed By” a Chief Officer and “Assigned To” a Senior Officer. Strategic risks are also reported on a bi- annual basis to the Performance & Monitoring Review Group. Service Risk 4.6 Following the methodology in 4.3 to 4.4 above, each service has owned operational risk registers in Pentana (the Council’s performance system) which were reviewed as part of the 2023/24 service planning process. 4.7 Significant financial funding reductions/limitations from Scottish Government SR001 is currently off target and is currently scored as sixteen compared to a target rating of four. Whilst the target rating is desirable, the Council is limited in its influence over the likelihood of it crystallising. COSLA continue to lobby the Scottish Government for fairer funding for Local Government. This includes contributions from the Council Leader and Chief Executive, supported by information provided by the Council’s Chief Officer Resources (S95 Officer) but ultimately, decisions over levels of local government funding are made by the Scottish Government. The likelihood of this risk is not expected to decrease in the medium-term with assumptions over future funding levels incorporated into projected budget gaps as reported in Financial Update reports presented to Council. There are ongoing discussions between the Scottish Government and Local Government in relation to a new deal, the removal of ring fencing and commitment to the recently signed Verity House Agreement however it is too early to say whether this will result in an improved funding position for local authorities which better reflects the need to fund essential services and cope with relatively high inflation. 4.8 Threat of Cyber Attack SR008 remains off target. The ever-changing digital landscape coupled with the current global socioeconomic and geopolitical climate has significantly increased the risk of cyber-attacks
Page 5
As this risk continues to be high the emphasis is still on the need for proactive measures to protect the confidentiality, integrity and availability of our data, critical infrastructure, and overall business operations. Key risks and continual threats remain the same: • Ransomware attacks – surged in recent years, potential for significant financial loss and operational disruption. • Advanced Persistent Threats (APT’s) – sophisticated stealthy attacks conducted by well-resourced groups, targets include critical infrastructure, government bodies and large corporations. • User awareness – Phishing attempts on the rise with more sophisticated techniques being deployed including voice and text phishing. Targeted threats tailored to specific areas of the Council are being observed. • Third Party Risks – The Council often relies on third party vendors and suppliers, increasing the risk of cyber-attacks through the supply chain. Mitigations: • Continual improvement of our vulnerability/patch management systems and processes. • Continual promotion of Cyber awareness through simulated phishing campaigns supported by our online security training and awareness platform. • The use of machine learning tools to baseline “normal” on our systems and highlight any deviation from this which could indicate potential compromise. • Improving Email security with enhanced Phishing/Spam identification. • Improved and more secure remote access solution being implemented. • Implementing stricter access controls. • Continual assessment of our Cyber Security posture. • Risk Assessments, DPIA, regular audits. • Creation of dedicated Cyber Security team and providing industry standard training. • Robust Business Continuity and Disaster Recovery plans. Progress continues to take place to improve our security posture in line with the national Public Sector Action plan (PSAP) and Public Sector Network (PSN) compliance. Vigilance of the National Cyber Security Centre (NCSC) Cyber Security guidance continues to remain in place. The cyber security landscape continues to evolve rapidly requiring ICT to adopt proactive measures to protect our assets and maintain business continuity. By understanding the current threat landscape, complying with relevant regulations and guidelines, managing third party risks, and establishing robust incident response and business continuity plans the Council is reducing our exposure to cyber security risks and building a resilient cyber security posture.
Page 6
Recent focus has centred on strengthening email security with enhanced user training capabilities and improving remote access with a more secure robust solution. Progress continues to improve our M365 security posture in addition to a review of our disaster recovery planning and incident management procedures. 4.9 Complexities in ensuring an appropriately resourced and resilient workforce The likelihood of SR007 has been raised taking the risk rating from 4 to 6. The difficult financial funding position means an impact on an appropriately resourced and resilient workforce is expected however the severity of this remains unclear. Services are reviewing structures and service delivery models in light of the council's financial challenges. The Workforce Planning Strategy is in place for 2022-2027. Additionally, the People First Strategy covers the same period and consolidates several areas: well-being, employee engagement, workforce planning, learning and development and digital. A robust package of wellbeing resources remains available, the council is recognised as a leading employer in terms of adapting flexible working practices, attendance levels are closely monitored, with personal stress and minor ailment absences currently prevalent. The Digital Skills Framework has been launched to support employees to keep abreast of digital skills and will support the Office 365 rollout. This year a Digital Skills survey was undertaken although the response rate was poor and will require further attention. Work to support the workforce with 365 and other technology developments is ongoing, and the remit of Digital Transformation board is being reviewed to better support the digital agenda. 4.10 Inability to reduce carbon footprint in line with targets The likelihood of SR0011 has been raised taking the risk rating from 4 to 6. Early emissions targets from 2013 to 2021 were achieved; however, both 2022 and 2023 targets were missed and a slowdown in carbon reduction is evident. This is likely due to a number of factors including the fact that most of the 'low hanging fruit' in terms of projects/initiatives have now been implemented. In order to ensure Net Zero emissions are achieved by 2045, significant funding and resource will be required to deliver more transformational and innovative initiatives. At present, it is unclear how this will be identified as there is a significant shortfall; hence the elevation of the 'Likelihood' status at this time. Should the council continue to miss targets, it is likely that greater than anticipated carbon offsetting initiatives will be necessary to address residual emissions which will likely be at a cost. 5. People Implications 5.1 There are no people implications associated with this report, other than in relation to the mitigation of risk.
Page 7
6. Financial and Procurement Implications 6.1 There are no financial and/or procurement implications directly associated with this report however there are in relation to any expenditure linked to mitigation. 7. Risk Analysis 7.1 Failure to ensure robust risk management is likely to result in the Council being criticised by External Auditors for not having an integrated approach to embedding risk management within the authority with the result that a “no scrutiny required” status would not be achieved. 7.2 Progressing with a robust risk management approach will demonstrate that the Council is taking ownership of risk management and ensuring effective measures are in place. The ability to demonstrate risk ownership should benefit the Council in terms of: • Understanding risk and its potential impact on the Council’s priorities and objectives; • Reducing insurance premiums going forward by recognising that a mature approach to risk management will contribute to a reduction in the number and value of claims across a range of insurance classifications; • Contributing towards incident prevention based upon post-incident investigation; • Meeting statutory/regulatory requirements; and Ensuring better partnership working with external and internal partners. 8. Equalities Impact Assessment (EIA) 8.1 EIA 548 notes the positive impacts of an approach to risk that integrates considerations on equalities, human rights health and social and economic impacts that is aligned with the content of the new Strategic Plan. 9. Consultation 9.1 The strategic risks have been discussed with the Chief Officers and senior management. The reports to committee are available to the Trades Union and consultation undertaken as required. 10. Strategic Assessment 10.1 At its meeting on 26 October 2022, the Council agreed that its five main strategic priorities for 2022 - 2027 are as follows: • Our Communities - Resilient and Thriving • Our Environment - A Greener Future • Our Economy - Strong and Flourishing
Page 8
• Our Council - Inclusive & Adaptable 10.2 The strategic risks have been identified to complement and underpin all strategic priorities. Name: Victoria Rogers Designation: Chief Officer People & Technology Date: 23 January 2024 Person to Contact: Anna Murray, Risk & Health and Safety Officer Anna.Murray@west-dunbarton.gov.uk Appendices: Appendix 1: Detailed Strategic Risk List Background Papers: West Dunbartonshire Council Strategic Plan 2022-2027 Risk Management Framework EIA screening