Strategic Risk Assurance Mapping
Argyll and Bute Council · 4 September 2025
Back to Audit and Scrutiny Committee — 4 September 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Classification: OFFICIAL ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 4 SEPTEMBER 2025 STRATEGIC RISK ASSURANCE MAPPING 1. EXECUTIVE SUMMARY 1.1 The purpose of this report is to set out Internal Audit's assessment of the sources of assurance for the Audit and Scrutiny Committee (the Committee) on the management of the Council's strategic risks. 1.2 Appendix 1 highlights the overall assessment against each of the strategic risks. It should be noted that the assessment is based on the level of assurance that the Committee can rely on. A 'red' assessment therefore highlights where there are gaps in evidence of active/targeted actions/activity rather than an assessment on the management of that risk. 2. RECOMMENDATIONS 2.1 To note and consider the risk assurance map at appendix 1. 3. DETAIL 3.1 Internal audit has a key role in relation to the Council’s governance to provide assurance over the effective management of risk. 3.2 The Chief Executive presents the Strategic Risk Register to the Committee on an annual basis which provides the Committee the opportunity to scrutinise the register and seek assurance from the Chief Executive that risks are being managed appropriately. 3.3 The CIA is of the view that the cumulative effect of these management arrangements both contribute to positive risk management reporting within Argyll and Bute Council but also maintaining an annual review in order to maintain appropriate overview and update of key emerging issues which will be reported to the Audit and Scrutiny Committee. 3.4 The Global Internal Audit Standards (GIAS) require that Internal Audit evaluate the effectiveness of the Council’s risk management process. However, it does not state this needs to be an annual exercise. Furthermore, it states that Internal Audit’s may gather the information to support an assessment of the effectiveness of risk management processes ‘during multiple engagements ‘and further states that ‘The results of these engagements, when viewed together, provide an understanding of the organisation’s risk management processes and their effectiveness. As such PSIAS does not require a full risk management audit on an annual basis. Furthermore, The CIPFA publication “Audit Committees: Practical Guidance for Local Authorities and Police” (2022 Edition)” requires the Audit Committee to have the option to consider risk management on a regular basis, regardless of who has operational responsibility for it. That option is always available.
Page 2
Classification: OFFICIAL 3.5 Appendix 1 provides a summary of the Council’s strategic risk assurance map which is based on the ‘three lines model’ (formerly known as the ‘Three Lines of Defence’). 1. The first line is the ‘functions that own and manage risks’. It is the control environment established by day-to-day business operations and risk management processes. It is formed by managers and staff who are responsible for identifying and managing risk as part of their accountability for achieving objectives. This requires an understanding of the Council, its objectives, the environment in which it operates, and the risks it faces. It includes things such as: • identifying risks and improvement actions • implementing controls • reporting on progress 2. The second line is the ‘functions that oversee or who specialise in compliance or the management of risk’. This provides the policies, frameworks, tools, techniques and support to enable risk and compliance to be managed in the first line, conducts monitoring to judge how effectively they are doing it, and helps ensure consistency of definitions and measurement of risk. The Council’s various committees and Strategic Management Team are key functions in delivering this element. 3. The third line is the ‘functions that provide independent assurance’. This is provided by internal and external audit and any other scrutiny or regulatory body who offer independent challenge and provide an evaluation, through a risk-based approach, on the effectiveness of the Council’s governance, risk management, and internal control.
Page 3
Classification: OFFICIAL 3.6 The table below summarises the assessment against each Strategic Risk. Strategic Risk Risk Score (August 2025) Assurance Assessment 1. Population, external infrastructure and economic decline Red 16 Green 2. Condition and suitability of infrastructure and asset base Amber 12 Green 3. Financial sustainability Amber 12 Green 4. Governance & leadership Amber 8 Green 5. Engagement and understanding the needs of the community Amber 9 Green 6. Service delivery Amber 12 Green 7. Health & Social Care Partnership Amber 12 Green 8. Civil contingency and business continuity arrangement are not effective Green 6 Amber 9. Waste management Red 16 Amber 10. Service delivery – Cyber Security Red 15 Amber 11. Cost of living crisis Amber 12 Amber 12. Impact of climate change Amber 12 Green 13. Lack of housing availability Red 20 Amber 14. Compliance with ‘Prevent’ Amber 9 Amber 3.7 The assurance map has not identified an area where there may be a concerning mismatch between the level of risk identified and the assurance provided to Committee. 3.8 3.9 Waste Management has been subject to regular monitoring and update from the service to the Council’s Audit and Scrutiny Committee, additional funding is to be provided from the Scottish Government of £1.5M to support the compliance with the BMW landfill ban. In addition, regular reports are being submitted to and are being monitored by the relevant service Committee of the Council. The Audit and Scrutiny Committee have identified the progress and arrangements for the implementation of the BMW landfill ban as the subject area which will be reviewed in 2025/26 as part of their scrutiny work. This will provide the Committee with a comprehensive overview of the arrangements relating to BMW. In relation to ‘Service Delivery – Cyber Security’ work has been undertaken in this area as part of the 2022/23 plan which provided a substantial level of assurance. Going forward, a planned review will be undertaken as part of the 2025/26 Internal audit plan putting additional audit resources into this area of risk, specifically, ICT Disaster Recovery Arrangements. However, it is relevant to note that work undertaken in 2022/23, 2023/24 and 2024/25 identified no significant concerns in relation to Cyber Security, Cloud Computing, Data Security and information Security and IT Risk Register and Mitigation Processes. Whilst this is in part reassuring, there is always a heightened risk to public bodies in relation to this critical area of business activity, together with increasing evidence of sustained attempts on public bodies within Scotland and the wider UK. The Council declared a Housing Emergency due to the risks associated with the Council, partner agencies and communities being unable to attract and retain working age people due to lack of housing and pricing. A housing summit in collaboration with housing delivery partners was held in December
Page 4
Classification: OFFICIAL 3.10 2023 in order to forge commitments aimed at tackling housing shortage which maximise resources, pursue innovation, coordinate planning and target delivery. A Housing Strategy and Investment Plan is being funded and implemented, with a new housing delivery group established; Plans are underway to approach this complex and difficult issue at both a national and local level. The remaining areas where assurance has been assessed as “amber” either have audit reviews already undertaken, scheduled or as part of the ongoing audit planning process. All changes to the Strategic Risk Register from September 2025 will be assessed in the 2026 Assurance Mapping Exercise. 4. CONCLUSION 4.1 This exercise has again confirmed that for the majority of risks in the Council’s strategic risk register there are either sufficient assurances in place or internal audit have scheduled work to fill identified gaps. Nevertheless, it is important to outline that such mitigations and assurances do not alone guarantee that an adverse event or risk will not present itself or materialise. 5. IMPLICATIONS 5.1 Policy - None 5.2 Financial - None 5.3 Legal - None 5.4 HR - None 5.5 Customer Service - None 5.6 Risk – The assurance mapping exercise has provided a satisfactory level of assurance that the Council is managing and monitoring its strategic risks effectively. 5.7 Climate Change - None 5.8 Fairer Scotland Duty - None 5.9 Equalities - protected characteristics - None 5.10 Consumer Duty - None 5.11 Island Communities - None 5.12 Children’s Rights and Wellbeing - None Paul Macaskill Chief Internal Auditor 4 September 2025 For further information contact: Paul Macaskill, Chief Internal Auditor, 01436 604108 APPENDICES Appendix 1 – Strategic Risk Assurance Map