Strategic Risk Assurance Mapping Appendix 1
Argyll and Bute Council · 5 September 2024
Back to Audit and Scrutiny Committee — 5 September 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
APPENDIX 1: Strategic Risk Assurance Map N o Risk Risk Score First Line of Defence Second Line of Defence Third Line of Defence Assessment 1 Population, External Infrastructure and Economic Decline Failure to identify relevant factors contributing to the decline and failure to develop strategies and actions targeting these factors. Red 16 • Service planning linked to Corporate Outcomes and the A&B Outcome Improvement Plan (ABOIP) • Community and multi- agency links through Community Planning Partnership • Parliamentary forum • Argyll, Lomond and Islands Rural Regeneration Initiative • Argyll and the Isles Strategic Tourism Partnership • Promotion and marketing of Argyll & Bute (ABplace2B campaign) • Business Gateway Service focused on helping local businesses grow • Council Leader engaging with leaders of other west coast councils suffering population decline • Economic Strategy and Action Plan monitored by ED&I Committee • CPP report on the progress being made against the outcomes and vision of the ABOIP and issue annual reports. • Monitoring of CPP plan and performance at CPP Management Committee. • Area Community Action Plans progress reported to Community Planning Groups • ABOIP targets population and economic recovery • Performance reports considered by A&SC, strategic committees and area committees External Audit • Best Value Assurance Report (May 2020) highlights Council’s and CPP partners commitment to a shared vision and that they recognise the challenges including the declining and aging population Internal Audit • Planning (2023/24 – (Substantial) Scrutiny • Economic Strategy (2019/20) Future • Rural Growth Deal Outline Business Cases and Final Business Cases being worked on and signing of Full Deal Agreement is expected in September 2024 • UK Shared Prosperity Funding Investment Plan is being actioned as per plan. • Multi-agency approach to refugee settlement underway linking with national processes and agendas.. • The council will continue as a partner of the There is a range of assurance sources across the three lines of defence.
Page 2
Highlands and Islands Regional Economic Partnership and lobby for Government investment to realise economic opportunity and address barriers to future sustainable growth. • Internal Audit Community Education (2024/25) • Short Term Lets (2024/25) 2 Condition and suitability of Infrastructure & Asset Base Infrastructure and asset base does not meet current and future requirements and is not being used or managed efficiently and effectively. Amber 12 • R&A Control Hub and Joint Operations Team • Operational risks monitored quarterly • Strategic Asset Mgt Board • Corporate Asset Management Strategy and Corporate Asset Management Plan • Service Asset Management Plans • Community Empowerment and Community Asset transfer arrangements in place • Roads Asset Management Plan • One Council Property Approach • Routine inspections of roads infrastructure to deal with potential weak areas • Revised capital management procedures Future • D&I performance reporting to ED&I Committee • Asset Mgt Plans reviewed annually by Council as part of the budget setting process • Status and Options reports to ED&I Committee Internal Audit • Community Empowerment Act (2018/19 - High) • Capital Monitoring (2020/21 - Substantial) • Management of Property Contracts (2020/21 - Reasonable) • Land & Asset Disposal (2021/22 - Substantial) • Internal Audit – Fixed Asset Register (2021/22) – Reasonable) • Piers and Harbours (2023/24 – Reasonable) Scrutiny • Roads Maintenance (2018/19) • Scrutiny – Community Asset Transfers (2021/22) Future • Leasing - Estates (2024/25) • Asbestos Management (2024/25 • Roads and Flood Prevention (2024/25) There is a range of assurance sources across the three lines of defence.
Page 3
• Modern Workspace Programme to review, and rationalise property portfolio for future needs of the Council. Changes on phased and town by town basis. Programme will be running for 3 years - April 2024 • Bridges Asset Management Plan and Inspection Regime (2024/25) 3 Financial Sustainability Insufficient resource to meet current and future service requirement. Budget not aligned / does not support business outcomes. Amber 12 • Budget preparation and monitoring • Medium term financial strategy with worst case, mid case and best case scenario planning • Treasury Mgt Policy • 5 year budget outlook updated quarterly • Financial Services Team aligned to service delivery • Regular engagement between budget holders and appointed finance contact • Reserve balances monitored throughout year • Financial monitoring and financial risk monitoring to P&R/BCC Committee • Budget and budget working papers considered by full Council • Financial Strategy reported to P&R Committee • 5 year budget outlook to P&R Committee • Treasury Mgt Annual Report to P&R Committee and A&SC • Joint SMT/Policy Leads meetings include discussions around financial issues Internal Audit • Continuous Monitoring • Financial Planning (2018/19 - Substantial) • Capital Monitoring (2020/21 - Substantial) • Internal Audit – Fixed Asset Register (2021/22) – Reasonable) • Internal Audit – Management of Debt and Recovery (2022/23) – Reasonable • Internal Audit – Financial Ledger (2023/24- Substantial) External Audit • Assessment of financial mgt via annual audit • Best Value Assurance Report (May 2020) highlights Council has good financial planning arrangements in place but could take steps to enhance its long-term strategy. (Strategy revise in 2021) • Assessment of budget There is a range of assurance sources across the three lines of defence.
Page 4
monitoring arrangements Future • Internal Audit – NDR (2024/25) • Rural Growth Deal Outline Business Cases and Final Business Cases being worked on and signing of Full Deal Agreement is expected September 2024. • Consider the implications and opportunities from the Visitor Levy (Scotland) Bill which could generate additional income from 2026/27. 4 Governance and Leadership Governance and leadership arrangements are not conducive to effective working and lead to a lack of strategic direction. Amber 8 • Corporate Governance Improvement Plan • Ongoing member development • Mentoring and coaching for SMT • Leadership development programme • Chief Exec Bilaterals • A&B Manager’s Course • Established partnership governance • Effective internal audit function • Scrutiny function • Performance Improvement framework • Council constitution • Oversight provided by Audit & Scrutiny Committee • Decision making committees open to public • Constitution updated and approved annually by Council • IA reports and follow up to DMT and SMT • Annual assurance statements • Fortnightly DMTs – weekly ELT and monthly SMTs Internal Audit • Continuous Monitoring • Organisational Culture (2018/19) • Performance Mgt (2018/19 - High) • Member Support (2018/19 - Substantial) • Risk Mgt 2018/19 – Substantial) • Following The Public Pound (2019/20 - Reasonable) • Annual self-assessment of PSIAS – external peer review every 5 years • Formal Induction of new Audit and Scrutiny Committee Members 2022 • Risk Management (2023/24 - Substantial) There is a range of assurance sources across the three lines of defence
Page 5
• Codes of conduct for staff and members • Code of Corporate Governance and Annual Action Plan • Scrutiny framework and scrutiny plan • Risk management embedded • Policy lead meetings • Area Committee Business Days External Audit • Ongoing independent assurance reported in AAR • Best Value Assurance Report (May 2020) recognises improvements in relationships between members and senior officers and more constructive and focused decision making Future • Scheduled reviews of Risk Management every two to three years. • Connect for Success priorities now form the basis of new corporate improvements and are being delivered. • Review of governance arrangements being undertaken with new administration to consider ongoing suitability of arrangements. 5 Engagement and Understanding the needs of the Community The Council fails to understand service user needs and emerging demographic trends and does not align service delivery to meet these. Amber 9 • Annual budget consultation • Complaints process • Community Engagement Strategy • Customer Service Board • Various user feedback (i.e. Refugee Resettlement, commissioned • Community Planning Partnership • Service Committees • Area Committees • DMT and SMT Internal Audit • Community Empowerment Act (2018/19 - High) • Complaints Handling (2021/22 – High) • Customer Service Centre (2022/23 – High) Other Agencies • Education Scotland and Care Inspectorate seek views of service users There is a range of assurance sources across the three lines of defence
Page 6
services, community council surveys) • Parental engagement strategy • Outreach service • Democracy matters consultation • Development Mgt user forums External Audit • Best Value Assurance Report (May 2020) highlights that Council has made good progress with the Community Empowerment Act, and regular monitoring in relation to all other outstanding issues have been closed after regular and detailed report to the Audit and Scrutiny Committee until June 2023. Scrutiny • Scrutiny – Community Asset Transfers (2021/22) • Scrutiny – Community Engagement (2022/23) Future • A cross service working group has been developing a community engagement framework, based on self-assessment, best practice, and employee consultation. The outcomes have been agreed by ELT and the framework is scheduled to be approved by P&R on 5 December 2024. (2024/25)
Page 7
6 Service Delivery Insufficient resources to ensure effective service delivery Amber 12 • Performance Improvement Framework • Rolling out programme of service self- assessment • Service improvement plans • Workforce planning • Complaints process • Use of LGBF • Strategic Plans with Success Measures aligned to Business Outcomes • Performance Improvement Officers • Performance reporting to A&SC, Service Committees and Area Committees • LGBF Review to A&SC, Service Committees and Area Committees • Self-Assessments reported to SMT and A&SC Internal Audit • Performance Mgt (2018/19 - High) • Complaints Handling (2021/22 – High) • IA annual plan is risk based but also designed to provide annual coverage of all Heads of Service • Internal Audit review of Human Resources (2023/24 – Substantial) External Audit • Best Value Assurance Report (May 2020) highlights that there is limited evidence of the Council using performance information to drive improvement and that Council’s performance reporting makes it difficult to conclude what progress has been made against its six corporate outcomes. This has now been fully addressed by the Council and a final report was presented to the Audit and Scrutiny Committee in March 2023 and all actions signed off as complete. Future • Review of Council’s Performance Mgt Framework being carried out by Customer Support Services and implementation of scheduled reviews. There is a range of assurance sources across the three lines of defence.
Page 8
7 Health and Social Care Partnership Failure of the HSCP to deliver on its Strategic Priorities results in deteriorating health and wellbeing outcomes for the population and / or reduced access to appropriate health and social care services. This could also result in financial and reputational risk to the Council. Amber 12 • Strategic Plan • Integration Scheme • IJB has elected member representation including Council Leader • Elected member representation on IJB Audit Committee (inc Vice Chair) • Council’s CIA regularly attends IJB Audit Committee • Regular engagement between Council CFO and HSCP CFO • Performance and financial monitoring and reporting in place and reported to IJB Board • HSCP Chief Officer sits on Council’s ELT Internal Audit • The IJB has their own IA function provided by the Council’s IA function (Contract started 1 April 2021) • Council’s IA function also provide assurance over social work services on an annual basis • Internal Audit - Charging for Non-Residential Services (2020/21 – Substantial) • Child Protective Services (2021/22) • Care Programme Approach (2021/22) • Complaints handling (2021/22 - Limited) • Workforce Planning (2021/22) • Client Funds (2022/23 – Limited) • Learning and physical Disabilities Care Packages (2023/24 - Substantial) • Client Funds (2023/24 - Reasonable) • SSSC Registration (2023/24 - Substantial) External Audit • IJB’s external auditors are Mazars. Future Internal Audits • External Placements (2024/25) • Eclipse System Post Implementation (2024/25) There is a range of assurance sources across the three lines of defence
Page 9
8 Civil Contingency & Business continuity arrangements are not effective. Green 6 • Critical activity recovery plans • Emergency planning test events • West of Scotland local resilience partnership • Community resilience plans • EU withdrawal tactical group • Emergency Mgt Support Team • EU tactical group progress reported to SMT Internal Audit • Business Continuity (2019/20 - Reasonable) • Internal Audit - Disaster Recovery Planning (2020/21 - Limited) • Internal Audit – Civil Contingencies (2021/22- Substantial) Future • The new BCM system has been procured and configured and a pilot project to test the system and the process is underway with 3 service areas, Procurement, Customer Engagement and Transformation Management and Residential (Care Home Services). Once the outputs form the pilot have been reviewed and the system goes live, all services will be required to complete a Business Impact Analysis, which will inform the basis for having a business continuity plan in place. This is expected to be completed by 31 March 2025. Moderate third level of defence assurance at current time. A project has commenced to review business continuity processes, covering critical activities and testing of CARPS. This is an area that will merit a follow up audit in the medium term future. However assurance can be taken from the Council’s response to COVID which was fast paced and has proven to be effective. 9 Waste Management Unable to dispose of waste in landfill sites due to the implications of the biodegradable municipal waste (BMW) landfill ban in 2021 Red 16 • Council rolling out new waste strategy • Using education and publicity to increase recycling • Performance reporting to EDI Committee • Progress monitoring by DMT and SMT Internal Audit • Waste Mgt (2018/19 - Limited) Scrutiny • Waste Mgt Strategy (2020/21) - On 27 April 2021 the Head of Roads and Infrastructure Services provided a presentation to Assurances over this risk are currently moderate due to the Council’s Waste Strategy being in its infancy and the full impact of the BMW ban still to
Page 10
the A&SC regarding the Council’s Waste Strategy followed by a question and answer session. Following the presentation the A&SC members agreed they were assured that appropriate progress was being made in relation to the Council’s waste strategy and that inclusion of a specific scrutiny topic focusing on the Strategy would not add value at this time. • A briefing note was requested by the A&SC in June 2022 relating to Waste Mgt and was presented by the HoS in September 2022. • A briefing and update report was presented to the A&SC in December 2023 by the HoS. Future • Confirmation received from the Scottish Government that £1.5m has been made available to support the compliance with the BMW Ban. • Ongoing workshop sessions to scope out and design future disposal models across all the council area. These models to be in place from 01/01/2026 in line with the BMW requirements. be realised, although now, in part mitigated by additional funding. However full implementation is not till 2026. The A&SC determined they are content that progress is reported to the EDI Committee and that the A&SC will maintain a watching brief.
Page 11
10 Service Delivery - Cyber Security Unable to deliver services to customers because of failure of ICT systems following major cyber security breach Red 15 • ICT Security & compliance officer in post, producing weekly threat analysis. • Regular patching regimes in place • ICT Disaster recovery plans tested regularly • Critical activities have recovery plans developed (CARP’s) • Progress monitoring by DMT and SMT Internal Audit • Business Continuity (2019/20 - Reasonable) • Disaster Recovery Planning (2020/21 - Limited) • Internal Audit – Cyber Security (2022/23 - Substantial) • Cloud Based Services (2023/24 - Substantial) Other Agencies • PSN and Cyber Essentials Plus accreditations for corporate network (doesn’t cover education network) Future • Internal Audit – Data Security and Information Security (2024/25) • IT Risk register and Mitigation Processes (2024/25) Moderate third level of defence assurance at current time. A project has commenced to review business continuity processes, covering critical activities and review/testing of CARPS. This is an area that will merit a follow up audit in the medium term future. 11 Cost of Living Crisis The Council are unable to respond to the implications arising from the 'Cost of Living' crisis Implementation of welfare reform is not managed well resulting in increased poverty and deprivation or short Amber 12 • Financial stability and support to HSCP. • Social Welfare and Poverty Funding assistance. • Focused support and multi-agency approach where risk is highlighted. • Monitoring of trends in service use to high light any significant change as a result of financial hardship • Targeted measures - for example to those • Progress monitoring by DMT and SMT • WRWG report to SMT • SMT monitor of risk and consider high and medium hardship cases • Anti-poverty strategy approved by Council • Child poverty action planning monitored by WRWG Internal Audit • HB & CTR (2018/109 – Substantial) • Internal Audit - Scottish Welfare Fund (2020/21 - Substantial) • Internal Audit - Welfare Rights (2020/21 - Substantial) Other Agencies • Focused support and multi-agency approach where risk is highlighted There is a range of assurance sources across the three lines of assurance in respect of welfare reform. However, Limited third tier assurance in respect of ‘Cost of Living Crisis but significant evidence of pro- active measures and support.
Page 12
term crisis. receiving Council Tax reductions - via Gift Cards and Flexible Food and Fuel Fund. • Financial Inclusion and Advice Group established. • Joint working with DWP, CPP and other agencies. • Flexible Food Fund created. Supporting householders in our area with funds and advice to address food and fuel insecurities. • Child Poverty Planning Group set up and active. Future Actions • Extend flexible food and fuel fund to March 2025. • Supporting the Poverty Alliance in their Tackling Rural Poverty project, observing its progress and considering outcomes as they emerge. • Preloved School Clothing Bank operating across Argyll and Bute. However assurance can be taken from the Council’s response to COVID which was fast paced and has proven to be effective. 12 Impact of Climate Change The Council or communities are overwhelmed by severe or more frequent flooding, landslides, rainfall, storms, sea level changes or hot weather events due to changes in global temperature caused by climate change. Amber 12 • Continued delivery of Council De- Carbonization Plan • Civil Contingencies Manager liaising/ collaborating with Regional Resilience Partnerships and other resilience partners in terms of storm event, hot weather events, cut off communities, landslides etc. • Development and delivery of an integrated approach to decarbonisation and adaptation of Argyll and Bute as a Region via Community Planning Partnership. • Roads & Amenity Services continue to develop asset management plan and • Progress monitoring by DMT and SMT Internal Audit • Climate Change Act (2021/22 - High) • Internal Audit – Civil Contingencies (2021/22- Substantial) Future Actions • Review of De-Carbonisation Plan December 2024. • Review scoring of business cases and pipeline of strategic projects with enhanced climate change considerations. There is a range of assurance sources across the three lines of defence
Page 13
address strategic risks in terms of rising sea levels, bridge repairs, and critical infrastructure vulnerability. 13 Lack of Housing Availability The Council, partner agencies and communities are unable to attract and retain working age people due to lack of housing and pricing Red 20 • Council has declared a Housing Emergency • Housing Strategy and Investment Plan funded and implemented/new housing delivery group established. • Islands Programme Award of Funding for infrastructure for worker accommodation on Mull - this is for phase 1 site infrastructure to enable delivery of accommodation for workers and will meet clearly evidenced community need. • Progress monitoring by DMT and SMT Future • Housing summit held in November and Action Plan being continually monitored/updated. • Updates to the Local Housing Strategy will reflect the Council's Housing Action Plan and will be reported to Council in November 2024. Limited third level of defence assurance at current time as it is a new item on the Strategic Risk Register. However, pro- active work is planned with partner agencies and review of the Housing Strategy.