Strategic Risk Assurance Mapping
Argyll and Bute Council · 15 September 2022
Back to Audit and Scrutiny Committee — 15 September 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 15 SEPTEMBER 2022 STRATEGIC RISK ASSURANCE MAPPING 1. EXECUTIVE SUMMARY 1.1 The purpose of this report is to set out Internal Audit's assessment of the sources of assurance for the Audit and Scrutiny Committee (the Committee) on the management of the Council's strategic risks. 1.2 Appendix 1 highlights the overall assessment against each of the strategic risks. It should be noted that the assessment is based on the level of assurance that the Committee can rely on. A 'red' assessment therefore highlights where there are gaps in evidence of active/targeted actions/activity rather than an assessment on the management of that risk. 2. RECOMMENDATIONS 2.1 To note the risk assurance map at appendix 1. 2.2 To consider the implications for audit or scrutiny coverage in the respective audit and scrutiny annual plans. In particular a potential scrutiny review focusing on waste management in 2023/24. 3. DETAIL 3.1 Internal audit has a key role in relation to the Council’s governance to provide assurance over the effective management of risk. 3.2 The Chief Executive presents the Strategic Risk Register to the Committee on an annual basis (usually June) which provides the Committee the opportunity to scrutinise the register and seek assurance from the Chief Executive that risks are being managed appropriately. 3.3 The CIA is of the view that the cumulative effect of the these management arrangements both contribute to positive risk management reporting within Argyll and Bute Council but also maintaining an annual review in order to maintain appropriate overview and update of key emerging issues which will be reported to the Audit and Scrutiny Committee. 3.4 The Public Sector Internal Audit Standards (PSIAS) require that Internal Audit evaluate the effectiveness of the Council’s risk management process. However it does not state this needs to be an annual exercise. Furthermore it states that Internal Audit’s may gather the information to support an assessment of the effectiveness of risk management processes ‘during multiple engagements ‘ and further states that ‘The results of these engagements, when viewed together, provide an understanding of the organisation’s risk management processes and their effectiveness . As such PSIAS does not require a full risk management audit on an annual basis. Furthermore The CIPFA publication “Audit Committees: Practical Guidance for Local Authorities and Police” (2018 Edition)”
Page 2
requires the Audit Committee to have the option to consider risk management on a regular basis, regardless of who has operational responsibility for it. That option is always available. 3.5 Appendix 1 provides a summary of the Council’s strategic risk assurance map which is based on the ‘three lines of defence’ model. 1. The first line of defence is the ‘functions that own and manage risks’. It is the control environment established by day to day business operations and risk management processes. It is formed by managers and staff who are responsible for identifying and managing risk as part of their accountability for achieving objectives. This requires an understanding of the Council, its objectives, the environment in which it operates, and the risks it faces. It includes things such as: identifying risks and improvement actions implementing controls reporting on progress 2. The second line of defence is the ‘functions that oversee or who specialise in compliance or the management of risk’. This provides the policies, frameworks, tools, techniques and support to enable risk and compliance to be managed in the first line, conducts monitoring to judge how effectively they are doing it, and helps ensure consistency of definitions and measurement of risk. The Council’s various committees and Strategic Management Team are key functions in delivering this element. 3. The third line of defence is the ‘functions that provide independent assurance’. This is provided by internal and external audit and any other scrutiny or regulatory body who offer independent challenge and provide an evaluation, through a risk-based approach, on the effectiveness of the Council’s governance, risk management, and internal control. 3.6 The table below summarises the assessment against each Strategic Risk. Strategic Risk Risk Score (June 2022) Assurance Assessment 1. Population and economic decline Red 16 Green 2. Condition and suitability of infrastructure and asset base Amber 12 Green 3. Financial sustainability Amber 12 Green 4. Governance & leadership Amber 8 Green 5. Engagement and understanding the needs of the community Amber 9 Green 6. Service delivery Green 6 Green 7. Health & Social Care Partnership Amber 12 Amber 8. Civil contingency and business continuity arrangement are not effective Green 6 Amber 9. Welfare reform Green 6 Amber 10. Waste management Red 16 Amber 11. Service delivery – Cyber Security Red 15 Amber 12. Impact of Covid-19 Amber 12 Green 3.7 The assurance map has not identified an area where there may be a concerning mismatch between the level of risk identified and the assurance provided to
Page 3
Committee. However, in relation Waste Management the risk score and assurance assessment in place are at the higher end of the amber scale, this was predominantly due to the Council being in the process of drafting and preparing a new waste strategy, together with the uncertainty being created by planned ban on landfilling Biodegradable Municipal Waste (BMW) which was due to be originally implemented in January 2021 but has been postponed until December 2025. In terms of balance, however, this problem is also affecting a number of other and more distant local authorities and creating similar risk assessment issues. The Council appears to be taking all reasonable steps it can to engage in discussion with the Scottish Government concerning the matter and outlining the significant costs that may be associated with compliance. The Audit and Scrutiny Committee may wish to consider this as a potential scrutiny topic in 2023/24 in order to allow further discussions and implications to be considered by the Council in the current financial year. 3.8 3.9 In relation to ‘Service Delivery – Cyber Security’; work is being undertaken in this area for 2022/23 as part of the Internal Audit Plan and that will help better inform the position in terms of assurance and our findings will be reported to the Audit and Scrutiny Committee in due course. The remaining areas where assurance has been assessed as “amber” either have audit reviews already undertaken, scheduled or as part of the ongoing audit planning process. All changes to the Strategic Risk Register from September 2022 will be assessed in the 2023 Assurance Mapping Exercise. 4. CONCLUSION 4.1 This exercise has again confirmed that for the majority of risks in the Council’s strategic risk register there are either sufficient assurances in place or internal audit have scheduled work to fill identified gaps. Nevertheless, it is important to outline that such mitigations and assurances do not alone guarantee that an adverse event or risk will not present itself or materialise. 5. IMPLICATIONS 5.1 Policy - None 5.2 Financial - None 5.3 Legal - None 5.4 HR - None 5.5 Equalities - None 5.6 Risk – The assurance mapping exercise has provided a satisfactory level of assurance that the Council is managing and monitoring its strategic risks effectively. 5.7 Customer Service – None Paul Macaskill Chief Internal Auditor 15 September 2022 For further information contact: Paul Macaskill, Chief Internal Auditor, 01436 604108 APPENDICES Appendix 1 – Strategic Risk Assurance Map