Strategic Risk Assurance Mapping
Argyll and Bute Council · 14 September 2023
Back to Audit and Scrutiny Committee — 14 September 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 14 SEPTEMBER 2023 STRATEGIC RISK ASSURANCE MAPPING 1. EXECUTIVE SUMMARY 1.1 The purpose of this report is to set out Internal Audit's assessment of the sources of assurance for the Audit and Scrutiny Committee (the Committee) on the management of the Council's strategic risks. 1.2 Appendix 1 highlights the overall assessment against each of the strategic risks. It should be noted that the assessment is based on the level of assurance that the Committee can rely on. A 'red' assessment therefore highlights where there are gaps in evidence of active/targeted actions/activity rather than an assessment on the management of that risk. 2. RECOMMENDATIONS 2.1 To note the risk assurance map at appendix 1. 3. DETAIL 3.1 Internal audit has a key role in relation to the Council’s governance to provide assurance over the effective management of risk. 3.2 The Chief Executive presents the Strategic Risk Register to the Committee on an annual basis which provides the Committee the opportunity to scrutinise the register and seek assurance from the Chief Executive that risks are being managed appropriately. 3.3 The Chief Internal Auditor (CIA) is of the view that the cumulative effect of these management arrangements both contribute to positive risk management reporting within Argyll and Bute Council but also maintaining an annual review in order to maintain appropriate overview and update of key emerging issues which will be reported to the Audit and Scrutiny Committee. 3.4 The Public Sector Internal Audit Standards (PSIAS) require that Internal Audit evaluate the effectiveness of the Council’s risk management process. However it does not state this needs to be an annual exercise. Furthermore it states that Internal Audit may gather the information to support an assessment of the effectiveness of risk management processes ‘during multiple engagements ‘ and further states that ‘The results of these engagements, when viewed together, provide an understanding of the organisation’s risk management processes and their effectiveness’. As such PSIAS does not require a full risk management audit on an annual basis. Furthermore The CIPFA publication “Audit Committees: Practical Guidance for Local Authorities and Police” (2022 Edition) requires the Audit Committee to have the option to consider risk management on a regular basis, regardless of who has operational responsibility for it. That option is always available.
Page 2
3.5 Appendix 1 provides a summary of the Council’s strategic risk assurance map which is based on the Three Lines Model (formerly known as the Three Lines of Defence). 1. The first line is the ‘functions that own and manage risks’. It is the control environment established by day to day business operations and risk management processes. It is formed by managers and staff who are responsible for identifying and managing risk as part of their accountability for achieving objectives. This requires an understanding of the Council, its objectives, the environment in which it operates, and the risks it faces. It includes things such as: identifying risks and improvement actions implementing controls reporting on progress 2. The second line is the ‘functions that oversee or who specialise in compliance or the management of risk’. This provides the policies, frameworks, tools, techniques and support to enable risk and compliance to be managed in the first line, conducts monitoring to judge how effectively they are doing it, and helps ensure consistency of definitions and measurement of risk. The Council’s various committees and Strategic Management Team are key functions in delivering this element. 3. The third line is the ‘functions that provide independent assurance’. This is largely provided by internal audit. 4. Other scrutiny is provided by external regulatory bodies which will include External Audit who offer independent challenge and provide an evaluation, through a risk-based approach, on the effectiveness of the Council’s governance, risk management, and internal control.
Page 3
3.6 The table below summarises the assessment against each Strategic Risk. Strategic Risk Risk Score (August 2023) Assurance Assessment 1. Population, external infrastructure and economic decline Red 16 Green 2. Condition and suitability of infrastructure and asset base Amber 12 Green 3. Financial sustainability Amber 12 Green 4. Governance & leadership Amber 8 Green 5. Engagement and understanding the needs of the community Amber 9 Green 6. Service delivery Green 6 Amber 7. Health & Social Care Partnership Amber 12 Green 8. Civil contingency and business continuity arrangement are not effective Green 6 Amber 9. Welfare reform Green 6 Green 10. Waste management Red 16 Amber 11. Service delivery – Cyber Security Red 15 Amber 12. Cost of living crisis Amber 12 Amber 13. Impact of climate change Amber 12 Green 14. Lack of housing availability Red 20 Amber 3.7 The assurance map has not identified an area where there may be a concerning mismatch between the level of risk identified and the assurance provided to Committee. 3.8 Waste Management has been subject to regular monitoring and update from the service to the Council’s Audit and Scrutiny Committee, it has been agreed that further updates be communicated to the Audit and Scrutiny Committee once it is better known the outcome of ongoing discussions with the Scottish Government. 3.9 In relation to ‘Service Delivery – Cyber Security’; work is being undertaken in this area for 2023/24 as part of the Internal Audit Plan, covering ‘Cloud Computing’ and that will help better inform the position in terms of additional assurance. However, it is relevant to note that work undertaken in 2022/23 identified no significant concerns in relation to Cyber Security. Whilst this is reassuring there is always a heightened risk to public bodies in relation to this critical area of business activity. 3.10 The Council declared a Housing Emergency due to the risks associated with the Council, partner agencies and communities being unable to attract and retain working age people due to lack of housing and pricing. A housing summit in collaboration with housing delivery partners is scheduled for autumn 2023, together with a planned update of the Local Housing Strategy to reflect current issues to be completed in December 2023. 3.11 The remaining areas where assurance has been assessed as “amber” either have audit reviews already undertaken, scheduled or as part of the ongoing audit planning process. All changes to the Strategic Risk Register from September 2023 will be assessed in the 2024 Assurance Mapping Exercise.
Page 4
4. CONCLUSION 4.1 This exercise has again confirmed that for the majority of risks in the Council’s strategic risk register there are either sufficient assurances in place or internal audit have scheduled work to fill identified gaps. Nevertheless, it is important to outline that such mitigations and assurances do not alone guarantee that an adverse event or risk will not present itself or materialise. 5. IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – None 5.5.2 Socio-Economic Duty – None 5.5.3 Islands Duty – None 5.6 Climate Change – None 5.7 Risk – The assurance mapping exercise has provided a satisfactory level of assurance that the Council is managing and monitoring its strategic risks effectively. 5.8 Customer Service – None Paul Macaskill Chief Internal Auditor 14 September 2023 For further information contact: Paul Macaskill, Chief Internal Auditor, 01546 604108 APPENDICES Appendix 1 – Strategic Risk Assurance Map