Strategic Risk Register
Argyll and Bute Council · 23 June 2022
Back to Audit and Scrutiny Committee — 23 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE CHIEF EXECUTIVE 23 JUNE 2022 STRATEGIC RISK REGISTER 1.0 INTRODUCTION 1.1 This report provides members with an update on the Council’s Strategic Risk Register (SRR). 2.0 RECOMMENDATIONS 2.1 It is recommended that the Audit and Scrutiny Committee endorse the updated SRR (Appendix 1). 3.0 DETAIL 3.1 The Council’s Constitution requires the Chief Executive to attend one meeting of the Audit and Scrutiny Committee per annum to report on how the Council is addressing its key strategic risks and other matters of interest. Anne Blue, Interim Head of Financial Services will present the update on behalf of the Chief Executive. 3.2 The format of the SRR and the Operational Risks Registers (ORR) and the processes to monitor and update them were revised in 2018 and subsequent internal audit reviews have confirmed compliance with these procedures. 3.3 The Council’s SRR continues to be updated by the SMT on a bi-annual basis on dates agreed with the Chief Internal Auditor (CIA) however it will also be updated if and when the Strategic Management Team (SMT) feel there is a specific requirement. 3.4 As required by the revised risk management manual, the SMT also review all risks in the ORRs which have been classified as ‘red’ by the Departmental Management Teams (DMT) to determine whether they should be escalated to the SRR. 3.5 The CIA performs an annual strategic risk register assurance mapping exercise which enables the Committee to assess the levels of assurance it can take over the activity undertaken by the Council to manage its strategic risks. This, alongside the annual Internal Audit plan including a three year cycle providing audit coverage across all the identified risks, provides assurance that the Council continues to proactively manage its risks.
Page 2
3.6 Appendix 1 to this paper provides a copy of the current SRR and demonstrates how the Council are treating the identified risks in terms of the mitigations currently considered to be in place and the action being taken to further reduce the residual risk 4.0 CONCLUSION 4.1 The SRR is subject to regular review by the SMT as are the red risks highlighted in ORRs by the DMTs. Risks are actively managed to reduce their impact upon the Council and the likelihood of them being realised. 5.0 IMPLICATIONS 5.1 Policy – None 5.2 Financial - None directly from this report however effective risk management assists with effective governance and stewardship of Council resources 5.3 Legal – None 5.4 HR - None 5.5 Fairer Scotland Duty - None 5.5.1 Equalities – None 5.5.2 Socio-Economic Duty – None 5.5.3 5.6 Islands Duty – None Climate Change - None 5.7 Risk – The report sets out the strategic risks facing the Council 5.8 Customer Service - None Pippa Milne Chief Executive 27 May 2022 For further information please contact: Moira Weatherstone, Interim Chief Internal Auditor (01546 604146) Appendices: 1. Strategic Risk Register
Page 3
APPENDIX 1 - STRATEGIC RISK REGISTER NEXT REVIEW DATE August 2022 Imp Lik Sc Imp Lik Sc 1 Population and Economic Decline Failure to identify relevant factors contributing to the decline and failure to develop strategies and actions targeting these factors. Our Economy is diverse and thriving Population decline reduces available funding impacting on Councils capacity to deliver services. A circle of decline with reduced employment, lower earning and failing businesses and poor perception of the area. Combined population and economic decline may increase the need for and cost of services. Insufficient people of working age with appropriate skills and experience to fill vacancies across CPP. Residual impact of withdrawal from EU. 5 4 20 1. Local outcome improvement plan targets population and economic recovery 2. Maximise external funding opportunities 3. Economic Strategy 4. Strategic infrastructure plan 5. Area economic development action plans 6.Promote and Market Argyll and Bute 7. Maximise social-eco benefits via effective partnership working 8. Single Investment Plan 4 4 16 Treat 1. Lobbying activity in pursuit of regional immigration policies and related strategies 2. Rural Growth Deal Outline Business Cases and Final Business Cases to be developed in 2022/23 and Deal to be signed late 2022 or early 2023. 3. Preparation of bid to Levelling Up Fund – preparing for April 2022 in time for submission date which is still to be confirmed. 4. Settlement Officer post agreed to be funded 50:50 from HIE/Council focusing on barriers to people living in communities, housing and others. 5. Preparation of a pipeline of projects across Argyll and Bute in order to be able to react to any other bid funding as and when it is announced. SMT 14 February 2022 Kirsty Flanagan 2 Condition and suitability of Infrastructure & Asset Base Infrastructure and asset base does not meet current and future requirements and is not being used or managed efficiently and effectively. Our Infrastructure supports sustainable growth Infrastructure and asset base does not support or is not aligned to business outcomes and does not aid effective service delivery. Infrastructure and asset base is allowed to deteriorate resulting in cost, lost opportunities and wasted resource. 4 4 16 1.Asset management board 2.Robust capital planning and monitoring 3. Asset management work plan 4. Business case modelling including sustainability, development and strategic change 5. Intelligence and best practice sharing via Heads of Property Group. 6. Community Empowerment and Community Asset Transfer – Arrangements in place to evaluate and determine requests. 7. Roads Asset Management Plan 8. Status and Options Report 9. R&A Services control hub and joint operations team 10. One Council Property Approach 4 3 12 Treat 1. Development of capital strategy in 2022. 2. 'Modern Workspace Programme will review, engage and rationalise property portfolio for future needs of the Council. Changes will take place on phased and town by town basis. Programme will be running for 3 years - April 2024 SMT 14 February 2022 Kirsty Flanagan and Douglas Hendry 3 Financial Sustainability Insufficient resource to meet current and future service requirement. Budget not aligned / does not support business outcomes. Enablers Unable to deliver Local outcome improvement plan. Reduction in performance. Reputational damage. 4 4 16 1. Longer term financial planning and financial strategy 2. Income generation activity 3. Robust budget preparation and budget monitoring protocols 4. Maintaining adequate contingency with reserves. 5. Digital transformation 6. Effective workforce planning model 7. Business Outcomes 8. Financial Services resilience building project including knowledge sharing and development of guidance notes 4 3 12 Treat 1. Discussions are continuing in respect of a change programme that will include ensuring that the Council can operate within its budget (2022 for year 2023/24). 2.Rural Growth Deal Outline Business Cases and Final Business Cases to be developed in 2022/23 and Deal to be signed late 2022 or early 2023. 3. Implementation of new general ledger system with enhanced budget planning and forecasting capabilities (July 2022) 4. Investment in professional training through Grow Our Own Activity. SMT 14 February 2022 Kirsty Flanagan Key Actions and Deadlines Risk OwnerGross Risk Residual Risk Last ReviewedNo Risk Consequences Current Mitigation ApproachCorporate Outcome
Page 4
Imp Lik Sc Imp Lik Sc Key Actions and Deadlines Risk OwnerGross Risk Residual Risk Last ReviewedNo Risk Consequences Current Mitigation ApproachCorporate Outcome 4 Governance and Leadership Governance and leadership arrangements are not conducive to effective working and lead to a lack of strategic direction. All Corporate Outcomes Poor decision making, lack of strategic direction. Lack of operational direction. Confidence in, and reputation of, the Council harmed. Deterioration in performance 4 4 16 1. Administration in place with working majority 2. Members Seminar programmes 3. Mentoring and Coaching Support for policy leads and Senior Management 4. Priorities agreed by Council 5.Corporate Plan sets out objectives 6. Performance Improvement Framework and Service Planning. 7. Leadership development programme. 8. Council constitution regularly reviewed and updated. 9. Established partnership governance arrangements 10. Scrutiny arrangements in respect of Police, Fire and Health. 11. Governance arrangements for scrutiny established 4 2 8 Treat 1. Monitor delivery of BV action plan (ongoing date) 2. Induction training for new Members following May elections (May/June 2022) SMT 14 February 2022 Pippa Milne 5 Engagement and Understanding the needs of the Community The Council fails to understand service user needs and emerging demographic trends and does not align service delivery to meet these. People live active, healthier and independent lives Enablers Prioritisation of services may not be aligned to community needs/views Gaps between community needs and Council services. Ineffective partnership working Services not configured to meet user/citizen requirements 3 4 12 1. Community Planning partnership 2. Community Engagement Strategy 3.Customer Service Board 4. Operation and development of panels and forums. Young people’s plan, citizens panel 5. Budget Consultation 6.Comprehensive Complaints Protocols 7.Demographic and end user analysis 3 3 9 Treat 1. Deliver agreed actions in BV3 action plan relating to Work with Communities and Community Groups to improve engagement - March 2022 SMT 14 February 2022 Pippa Milne 6 Service Delivery Insufficient resources to ensure effective service delivery Enablers Services fail to achieve agreed performance levels and as a result are not contributing fully to Council objectives Resources are poorly managed with result that agreed outcomes and objectives are not fully achieved. Unable to achieve continuous improvement and improve effectiveness and efficiency 3 3 9 1. Performance Improvement Framework 2.Service Improvement plans 3.Argyll and Bute Manager programme 4. Customer needs analysis Protocols 5.Demographic and end user analysis 6.Workforce Planning 7.Internal and External Scrutiny Arrangements 8.Complaints process 3 2 6 Treat 1. Monitor progress of performance mgt project and implement recommendations (Ongoing from Oct 2020 to June 2022) SMT 14 February 2022 Kirsty Flanagan and Douglas Hendry 7 Health and Social Care Partnership Failure to deliver strategic objectives and integrate Health and Social Care services in an efficient and effective manner exposes the Council, as a key partner, to unacceptable financial and reputational risk. People live active, healthier and independent lives Partnership viewed as having failed or not achieved strategic objectives Partnership Failure or weakness exposes Council to significant Financial liability Confidence in, and reputation of, the Council harmed 5 4 20 1. HSCP integration scheme approved by Scottish government 2. Strategic Plan in place 3. Performance and Financial reporting arrangements in place 4. Independent audit arrangements in place. 5. Integrated Joint board with elected member representation including Council Leader 6.Chief Officer member of ABC Senior Management Team with co-location of officers 7. Tripartite leadership agreement 8. Monitoring of HSCP financial position. 4 3 12 Treat 1. Develop options to deliver sustainability of future years budgets (ongoing) 2. Completion of Strategic Plan which was delayed due to COVID. 3. Assessment on impact of COVID on services in short, medium and long term. SMT 14 February 2022 Fiona Davies
Page 5
Imp Lik Sc Imp Lik Sc Key Actions and Deadlines Risk OwnerGross Risk Residual Risk Last ReviewedNo Risk Consequences Current Mitigation ApproachCorporate Outcome 8 Civil Contingency & Business continuity arrangements are not effective. People live in safer and stronger communities Ineffective management of major emergencies affecting Council services and communities in Argyll and Bute. Incident and recovery phase of an emergency lead to greater inconvenience and hardship and a longer timescale for return to normal. Council unable to effectively deliver its own services 2 4 8 1. Emergency Planning Test events 2. Critical Activity Recovery Plans 3. Roll out of Community resilience partnership programme 4. Peer review of major exercises undertaken to provide external validation of planning process 5. West of Scotland local resilience partnership 6.Cross sector expertise and partnership working 7. Emergency Management Support Team (EMST) meetings 8. Training 9. EU Withdrawal Tactical Working Group with arrangements for reporting to the West of Scotland Resilience Partnership 2 3 6 Treat 1. ‘Develop long term test schedule for DRPs to be presented to the SMT (December 2021) - UPDATE? SMT 14 February 2022 Douglas Hendry 9 Welfare Reform Implementation of welfare reform is not managed well resulting in increased poverty and deprivation or short term crisis People live active, healthier and independent lives Financial crisis and hardship for individuals Increase in demand or costs for Council Services 4 3 12 1. Financial Inclusion and Advice Group established 2. Joint working with DWP, CPP and other agencies 3. Child Poverty Planning Group set up and active 4. Flexible Food Fund created. Supporting householders in our area with funds and advice to address food and fuel insecurities 3 2 6 Tolerate 1. Extend Flexible Food Fund Contract for a further year to March 2023. 2. Council, HSCP and third sector deliver range of 20 Covid related support projects under the Flexible Fund banner by March 2023. 3. Deliver sustainable school clothing bank across the Argyll and Bute area by December 2022. 4. One-off top-up payments of £75 per child issued to School Clthing Grant recipients by end of February 2022. 5. Argyll and Bute centric anti-poverty training delivered to 600 Council, NHS and third sector staff by March 2022. 6. "Worrying about money" leaflet to be issued with Council Tax bills containing advice and support for people with money worries in March 2022. Update website with information and support. SMT 14 February 2022 Douglas Hendry 10 Waste Management Unable to dispose of waste in landfill sites due to the implications of the biodegradable municipal waste (BMW) landfill ban in 2025 Our Infrastructure supports sustainable growth Alternative delivery models would be likely to be more expensive than the current one which would result in cost pressures having to be accommodated by other services and service provision reduced 5 4 20 1. Helensburgh and Lomond waste solutuion available via third party offtakers 2. Waste strategy 4 4 16 Treat 1.Progress on developing delivery models to be reported to EDI Committee (ongoing) SMT 14 February 2022 Kirsty Flanagan
Page 6
Imp Lik Sc Imp Lik Sc Key Actions and Deadlines Risk OwnerGross Risk Residual Risk Last ReviewedNo Risk Consequences Current Mitigation ApproachCorporate Outcome 11 Service Delivery - Cyber Security Unable to deliver services to customers because of failure of ICT systems following major cyber security breach Our Economy is diverse and thriving Threat of ransomware attacks. Data corruption of ICT system caused by malware and/or loss of confidential data. ICT Systems unavailable for considerable period whilst recovery from uncorrupted backups takes place. Meanwhile Services fail to achieve agreed performance levels and as a result are not contributing fully to Council objectives. Reputational damage to Council and potential financial losses (fines, loss of income). 5 4 20 1. ICT Security & compliance officer in post, producing weekly threat analyses, member of CiSP 2. PSN and Cyber Essentials Plus accreditations for corporate network 3. Regular patching regimes in place 4. ICT Disaster recovery plans tested regularly 5. All critical activities have recovery plans developed (CARP’s) 5 3 15 Treat 1. Review all contingency plans with updated knowledge from SEPA and UHI Cyber Attacks. 2. Work with Scottish Government Cyber Resilience Team to test ICT response 3. Issue regular communications to raise awareness of importance of cyber security and awareness 4. Enforce password changes when found to be weak 5. Cyber Security Resilience Exercise planned for late February 2022. 6. Continued close review of disaster recovery plan and associated tests, finalise and test incident response procedure, and review of mirroring between the 2 data centres (monthly at ITMT) and backup 7. Review and progress requirements for Education Network to achieve CE+ accreditation SMT 14 February 2022 Kirsty Flanagan 12 Impact of COVID -19 The Council are unable to deliver core services as a result of the Covid 19 virus with adverse impact to community and the economy Our Economy is diverse and thriving 1. Unable to meet national and Scottish Government guidance in terms of control of the virus 2. Inability to deliver core services 3. Not engaged in national and regional resilence groups with partner agencies 4. Disruption of flow of goods, services and supply chains 5. Adverse impact on workforce, communities with regards to economy and population. 5 5 25 1. Establishment of Strategic and Tactical Groups with links to HSCP, NHS and national/regional resilence groups 2. Tactical team via the Civil Contingencies Manager liaising/ collaborating with Regional Resilience Partnerships and other resilience partners. 3. Development and delivery of an integrated approach to deliver decisions and mitigations 4. SITREP reporting thorugh contigency planning structures in place 4 3 12 Treat 1. Development and regular review of Economic Recovery workstream with input from representatives across the organisation and the Health and Social Care Partnership. 2. Assessment of COVID on wellbeing and service capacity/sustainability. 3. P&R Committee in December 2021 agreed funding of £110k from the Recovery and Renewal Fund to aid delivery of critical areas of the Recovery Strategy and Action Plan which will create 2 teporary posts for a 12 month period. SMT 14 February 2022 Pippa Milne