Strategic Risk Assurance Mapping
Argyll and Bute Council · 5 September 2024
Back to Audit and Scrutiny Committee — 5 September 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 5 SEPTEMBER 2024 STRATEGIC RISK ASSURANCE MAPPING 1. EXECUTIVE SUMMARY 1.1 The purpose of this report is to set out Internal Audit's assessment of the sources of assurance for the Audit and Scrutiny Committee (the Committee) on the management of the Council's strategic risks. 1.2 Appendix 1 highlights the overall assessment against each of the strategic risks. It should be noted that the assessment is based on the level of assurance that the Committee can rely on. A 'red' assessment therefore highlights where there are gaps in evidence of active/targeted actions/activity rather than an assessment on the management of that risk. 2. RECOMMENDATIONS 2.1 To note the risk assurance map at appendix 1. 3. DETAIL 3.1 Internal audit has a key role in relation to the Council’s governance to provide assurance over the effective management of risk. 3.2 The Chief Executive presents the Strategic Risk Register to the Committee on an annual basis which provides the Committee the opportunity to scrutinise the register and seek assurance from the Chief Executive that risks are being managed appropriately. 3.3 The CIA is of the view that the cumulative effect of these management arrangements both contribute to positive risk management reporting within Argyll and Bute Council while also maintaining an annual review to provide appropriate overview and update of key emerging issues, which will be reported to the Committee. 3.4 The Public Sector Internal Audit Standards (PSIAS) require that Internal Audit evaluate the effectiveness of the Council’s risk management process. However, it does not state this needs to be an annual exercise. Furthermore it states that Internal Audit may gather the information to support an assessment of the effectiveness of risk management processes ‘during multiple engagements ‘and further states that ‘The results of these engagements, when viewed together, provide an understanding of the organisation’s risk management processes and their effectiveness‘. As such PSIAS does not require a full risk management audit on an annual basis. Additionally, The CIPFA publication “Audit Committees: Practical Guidance for Local Authorities and Police” (2022 Edition) requires the Audit Committee to have the option to consider risk management on a regular basis, regardless of who has operational responsibility for it. That option is always available.
Page 2
3.5 Appendix 1 provides a summary of the Council’s strategic risk assurance map which is based on the ‘three lines model’ (formerly known as the Three Lines of Defence). 1. The first line is the ‘functions that own and manage risks’. It is the control environment established by day to day business operations and risk management processes. It is formed by managers and staff who are responsible for identifying and managing risk as part of their accountability for achieving objectives. This requires an understanding of the Council, its objectives, the environment in which it operates, and the risks it faces. It includes things such as: • identifying risks and improvement actions • implementing controls • reporting on progress 2. The second line is the ‘functions that oversee or who specialise in compliance or the management of risk’. This provides the policies, frameworks, tools, techniques and support to enable risk and compliance to be managed in the first line, conducts monitoring to judge how effectively they are doing it, and helps ensure consistency of definitions and measurement of risk. The Council’s various committees and Strategic Management Team are key functions in delivering this element. 3. The third line of defence is the ‘functions that provide independent assurance’. This is provided by internal audit. 4. Other scrutiny is provided by external regulatory bodies which will include External audit who offer independent challenge and provide an evaluation, through a risk-based approach, on the effectiveness of the Council’s governance, risk management, and internal control.
Page 3
3.6 The table below summarises the assessment against each Strategic Risk. Strategic Risk Risk Score (August 2024) Assurance Assessment 1. Population, external infrastructure and economic decline Red 16 Green 2. Condition and suitability of infrastructure and asset base Amber 12 Green 3. Financial sustainability Amber 12 Green 4. Governance & leadership Amber 8 Green 5. Engagement and understanding the needs of the community Amber 9 Green 6. Service delivery Amber 12 Green 7. Health & Social Care Partnership Amber 12 Green 8. Civil contingency and business continuity arrangements are not effective Green 6 Amber 9. Waste management Red 16 Amber 10. Service delivery – Cyber Security Red 15 Amber 11. Cost of living crisis Amber 12 Amber 12. Impact of climate change Amber 12 Green 13. Lack of housing availability Red 20 Amber 3.7 The assurance map has not identified an area where there may be a concerning mismatch between the level of risk identified and the assurance provided to Committee. 3.8 3.9 3.10 Waste Management has been subject to regular monitoring and update from the service to the Council’s Audit and Scrutiny Committee, with the latest update in December 2023. Additional funding is to be provided from the Scottish Government of £1.5M to support the compliance with the BMW ban. In addition, regular reports are being submitted to and are being monitored by the relevant service Committee of the Council. In relation to ‘Service Delivery – Cyber Security’; work has been undertaken in this area as part of the 2022/23 plan which provided a substantial level of assurance. Going forward two planned reviews will be undertaken as part of the 2024/25 Internal audit plan putting additional audit resources into this area of risk, specifically, Data Security and Information Security as well as the IT Risk Register and Mitigation Processes. However, it is relevant to note that work undertaken in 2022/23 and 2023/24 identified no significant concerns in relation to Cyber Security or Cloud Computing. Whilst this is in part reassuring, there is always a heightened risk to public bodies in relation to this critical area of business activity. The Council declared a Housing Emergency due to the risks associated with the Council, partner agencies and communities being unable to attract and retain working age people due to lack of housing and pricing. A housing summit in collaboration with housing delivery partners was held in December 2023 in order to forge commitments aimed at tackling housing shortage which maximise resources, pursue innovation, coordinate planning and target delivery. Plans are underway to approach this complex and difficult issue at both a national and local level.
Page 4
3.11 The remaining areas, where assurance has been assessed as “amber”, either have audit reviews already undertaken, scheduled or included as part of the ongoing audit planning process. All changes to the Strategic Risk Register from September 2024 will be assessed in the 2025 Assurance Mapping Exercise. 4. CONCLUSION 4.1 This exercise has again confirmed that for the majority of risks in the Council’s strategic risk register there are either sufficient assurances in place or internal audit have scheduled work to fill identified gaps. Nevertheless, it is important to outline that such mitigations and assurances do not alone guarantee that an adverse event or risk will not present itself or materialise. 5. IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – The assurance mapping exercise has provided a satisfactory level of assurance that the Council is managing and monitoring its strategic risks effectively 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None Paul Macaskill Chief Internal Auditor 5 September 2024 For further information contact: Paul Macaskill, Chief Internal Auditor, 01436 604108 APPENDICES Appendix 1 – Strategic Risk Assurance Map