Agenda Document Pack - Audit Committee - 30/09/2025
Midlothian Council · 30 September 2025
Back to Audit Committee — 30 September 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Notice of Meeting and Agenda Audit Committee Venue: Normandy Court/ Hybrid, Normandy Court, 20 Normandy Dr, Dalkeith, EH22 1JG Date: Tuesday, 30 September 2025 Time: 11:00 Executive Director : Place Contact: Clerk Name: Democratic Services Clerk Telephone: Clerk Email: democratic.services@midlothian.gov.uk Further Information: This is a meeting which is open to members of the public. Privacy notice: Please note that this meeting may be recorded. The recording may be publicly available following the meeting. If you would like to know how Midlothian Council collects, uses and shares your personal information, please visit our website: www.midlothian.gov.uk Page 1 of 128
Page 2
1 Welcome, Introductions and Apologies 2 Order of Business Including notice of new business submitted as urgent for consideration at the end of the meeting. 3 Declaration of Interest Members should declare any financial and non-financial interests they have in the items of business for consideration, identifying the relevant agenda item and the nature of their interest. 4 Minute of Previous Meeting 4.1 Minute of Audit Committee meeting of 16 June 2025 submitted for approval 5 - 18 4.2 Action Log 19 - 20 5 Public Reports 5.1 Audit Committee - Nomination of Chair, report by Chief Officer Corporate 21 - 28 5.2 Annual Audit Report to Members and the Controller of Audit – year ended 31 March 2025, report by Audit Scotland, External Auditor – to follow 5.3 Annual Accounts for the year ended 31 March 2025, report by Chief Financial Officer & Section 95 Officer – to follow 5.4 Internal Audit Work to September 2025, report by Chief Internal Auditor 29 - 40 5.5 Audit Committee Annual / End of Term Report 2024/25, report by Chair of the Audit Committee 41 - 60 5.6 Risk Management Policy and Strategy, report by Chief Officer Place 61 - 86 5.7 Strategic Risk Management – Strategic Risk Profile Quarter 1, 2025-26, report by Chief Officer Place 87 - 128 6 Private Reports No items for discussion Page 2 of 128
Page 3
7 Date of Next Meeting The next meeting will be held on Tuesday 2 December 2025 at 11am. Page 3 of 128
Page 4
Page 4 of 128
Page 5
Audit Committee Tuesday 30 September 2025 Item No 4.1 Audit Committee Date Time Venue Monday 16 June 2025 11am Council Chambers/Hybrid Present: Councillor McEwan (Chair) Councillor Bowen Councillor McCall Councillor Milligan (virtual) Councillor Smaill In Attendance: Councillor Alexander (virtual) Councillor McKenzie (virtual) Dr Grace Vickers, Chief Executive Kevin Anderson, Executive Director Place Morag Barrow, Joint Director Health and Social Care and Chief Officer to Midlothian Integration Joint Board (Virtual) David Gladwin, Chief Financial Officer/Section 95 Officer Saty Kaur, Chief Officer Corporate Solutions Derek Oliver, Chief Officer Place Duncan Stainbank, Chief Internal Auditor Michelle Strong, Education Chief Operating Officer Alan Turpie, Legal and Governance Manager and Monitoring Officer Michelle Blair, Chief Internal Auditor, East Renfrewshire Council Patricia Fraser, Senior Audit Manager, Audit Scotland Claire Gardiner, Audit Director, Audit Scotland Gary Thomson, Senior Finance Business Partner Louise Middleton, Democratic Services Officer Page 5 of 128
Page 6
Maria Perez, Democratic Services Officer 1. Welcome and Apologies for Absence The Chair welcomed everyone to the meeting of the Audit Committee. 2. Order of Business The Legal and Governance Manager noted that the report for item 5.3 in the agenda (Unaudited Annual Accounts 2024/25) was issued as a late paper on Thursday 12 June 2025 and asked the Chair that this was accepted in the order of business as a matter of urgency. The Chair accepted that the paper is added to the order of business. 3. Declarations of interest No declarations of interest were intimated at this stage of the proceedings. 4. Minute of Previous Meeting Minutes of the previous meeting held 24 February 2025 were submitted for approval. Councillor Smaill noted that they were unable to attend this meeting due to a diary clash however they are listed as an attendee. The Chair asked that the minutes are amended and asked the Committee whether they approve the minutes with the amendment requested by Councillor Smaill as the correct record. Action - Democratic Services to review the list of attendees at 24 February 2025 Audit Committee and correct where required. Councillor McCall moved to approve the minutes, this was seconded by Councillor Bowen. The Chair pointed out the two items on the action log are marked for closure and asked the Committee whether they approve with them being closed. Councillor McCall moved to close both items and Councillor Bowen seconded the motion. Page 6 of 128
Page 7
5. Public Reports Report No. Report Title Submitted by: 5.1 Midlothian Council Transformation: how councils are redesigning and delivering more efficient services to achieve planned outcomes Audit Scotland Outline of report and summary of discussion The Audit Director, Audit Scotland presented the report for noting. This is the third report in the in Best Value Thematic Review series. This report is due to be published in Audit’s Scotland annual report alongside the annual accounts after they are signed by the External Auditors. The Audit Director highlighted key messages - Midlothian Council has developed a clear transformation blueprint to address the £8.9 million budget gap and ensure long term service sustainability by pursuing a wide number of initiatives. While Audit Scotland is satisfied that there is effective governance oversight from the Business Transformation Board and Business Transformation Steering Group, it has been noted that the pace of the transformation should be accelerated to meet the financial targets. The following examples of good practice were highlighted by auditors: • Workforce Development • Strategic Alignment • Digital transformation • Community engagement It was also noted the transformation is aligned with the Medium-Term Financial Strategy and Single Midlothian Plan. There is also evidence of strong collaboration with National Health Service, Police Scotland and other agencies, for example in projects such as the Number 11 Recovery Hub and Midlothian Energy Limited. The report also notes the good community engagement to date, and the commitment to engage with service users. The Audit Director, Audit Scotland noted there are five recommendations in the report, of which recommendations 2,4 and 5 are highlighted. These recommendations are not identifying a gap, they are intended to encourage a consistent approach. The first of those recommendations is to finalise the cost of projects and clearly define savings, costs and benefits for priority transform projects, which is being progressed by the Council. The final recommendation is the plan for the Project Management Office sustainability, and this means developing a long-term resourcing plan for transformation, beyond current plans to future proof the Council. The Chair thanked the Audit Director, Audit Scotland for their report and invited questions. Page 7 of 128
Page 8
The Committee noted the report stresses income generating initiatives and asked whether there was a conscious decision to exclude Hillend from this list. The Audit Director advised that this was a conscious decision, as it was only possible to focus on one or two case studies due to budget constraints. Audit Scotland and External Auditors took advice from Midlothian Council on which case studies would best exemplify transformation. Decision The Audit Committee noted the contents of the report. Report No. Report Title Submitted by: 5.2 Annual Treasury Management Report 2024/25 Chief Financial Officer/Section 95 Officer Outline of report and summary ofiscussion The Chief Financial Officer/Section 95 Officer presented the report for decision, informing members of the Audit Committee of the Treasury Management activity undertaken in 2024/25 and outlining the year-end position. The Audit Committee is invited to consider this report before the final report is presented to Council. The main point highlighted is the loans fund rate of 2.73%, which has increased from the previous year’s rate reflecting the higher cost of new borrowing. However, Midlothian remains as the Local Authority with the lowest fund rate in Scotland. There has also been £40 million worth of new long-term borrowing to meet cash flow requirements, taking advantage of good rates which offset the cost. The approved Treasury Strategy is to refinance borrowing, when rates soften. The Council were under borrowed by £90 million on 31 March 2025. £26 million pounds are in instant access accounts, and the Council does not have any deposits with other Local Authorities. The current forecasts suggest a gradual reduction of interest rates over the year. There are sustained higher borrowing rates that pose a challenge to Council in finance capital expenditure in the near term. The Finance Team will meet with Treasury advisors to review strategy and submit any proposed amendments to Elected Members for approval. The Chair thanked the Chief Financial Officer/ Section 95 Officer for their report and opened for questions. The Committee praised the current strategy and queried whether the ability to deposit up to £30 million with any bank part owned by the state is still under consideration. The Senior Finance Business Partner advised that this is an area that needs to be explored and reported on in the next financial year. Page 8 of 128
Page 9
Councillor McCall moved to approve the recommendations of the report, seconded by Councillor Bowen. Decision The Audit Committee approved the recommendations set out in the report. Report No. Report Title Submitted by: 5.3 Unaudited Annual Accounts 2024/25 Chief Financial Officer/ Section 95 Officer Outline of report and summary of discussion The Chief Financial Officer/Section 95 Officer presented the report for noting. It was highlighted that once the unaudited accounts are considered by the Audit Committee, they will be signed by the Chief Financial Officer/Section 95 Officer, to then be published and submitted for inspection by the 30 June 2025. The audited accounts will be presented to the Council in September 2025 for formal approval. It was noted that the accounts are a technical document, which may be complex for many to grasp. There is also an expenditure and funding analysis on page 31 of the report, which summarises how annual expenditure is used and funded from resources such as grants and Council Tax, and what resources have been consumed. This is a bridge between the management accounts that are presented on a quarterly basis. The report highlights movement in reserves since start of the year. Detailed information on reserves will be presented to Council on 24 June 2025. The report includes a comprehensive income and expenditure statement in accordance with international financial standards, as well as a balance sheet with net assets and net equity. Other sections that were highlighted in the report are the management commentary, which helps gain a better understanding of the accounts, the statement of responsibilities detailing the role of the Section 95 Officer, and the Annual Governance Statement which will be covered in item 5.10 of the agenda. The Chief Financial Officer/Section 95 Officer asked Audit Committee members to note the implementation of International Finance Reporting Standards leases in 2024/25. This requires recognition of assets and liabilities for all leases where previously many of these were treated as revenue expense. The figures in this report are based on estimates and accounts may be adjusted before being submitted to the auditor following final information received from colleagues last week. The other matter of note is ongoing discussions over methodology to value Council houses. The Chief Financial Officer/Section 95 Officer noted they are not yet comfortable with the valuation system, and this will be reviewed with Audit Scotland during the audit period. The account shows some areas of movement in housing stock, and the value of long-term assets has increased by £30 million reflecting Page 9 of 128
Page 10
investment in the asset base. The Lothian Bus account to 31 December 2024 also shows an increase of assets of £9 million increasing the Council’s share to £489,000. The pension asset value has increased by £87 million from a year ago, and unfunded obligations have decreased to £6.4 million, which is seen as a liability. The combined value of short-term investment and cash and cash equivalents at the balance sheet date was £27 million, which is a reduction of £20 million from those held on 31 March 2025. Long term liabilities have fallen by £2.4 million as Public Private Partnership (PPP) and other contracts move towards expiry. As well as the Council’s accounts, the Finance Team is presenting group accounts for Midlothian Integration Joint Board, Lothian Valuation Board and Midlothian Energy Limited, Trusts Bequests, Common Goods and Community Funds, as shown on page 87 of the accounts. The Chair thanked the Chief Financial Officer & Section 95 Officer for the report. The Chair also thanked the Committee for accepting this report as a late paper and invited questions. The Committee queried that states the Council employs 5,357 people, whether this is FTE (Full Time Employment) places, and whether Midlothian House has been considered in figures for impaired assets considering the future refurbishment. The Chief Financial Officer/Section 95 Officer confirmed the employee figure is for number of staff not FTE and for the impairment of the Midlothian House asset it would be possible to look at the nature of the disclosure relating to the building and be more transparent, if that is the wish of the Committee. The Committee also queried the value given for the Council’s house stock which is £50,000 and whether this is too low. The Chief Financial Officer/Section 95 Officer advised that the value given for Council Housing stock is a tried and tested method that considers risk guidance and removes 68% to account for the discount factor. The Chief Financial Officer/Section 95 Officer offered to provide additional sector guidance if the Committee wish to look at this matter in depth. The Chair queried whether the Council houses are revalued when refurbishment such as replacing doors, windows and kitchens takes place. The Chief Financial Officer/Section 95 Officer confirmed that when capital expenditure in housing stock is made, this is reflected in the gross value of the asset, as it enhances the nature and life of the asset. The Audit Director, Audit Scotland confirmed that Audit Scotland also looks at the discount factor as part of an audit, and while there is some variation among Local Authorities in Scotland and England it tends to be around 60%-70%. The Committee suggested that future reports include a glossary to explain acronyms used in the report. The Chief Financial Officer/Section 95 Officer advised that they will consider the use of acronyms in their future reporting. Page 10 of 128
Page 11
Decision The Audit Committee noted the contents of the unaudited Annual Accounts 2024/25 Report No. Report Title Submitted by: 5.4 Accounts Commission – Local Government Budgets 2025/26 Chief Financial Officer & Section 95 Officer Outline of report and summary of discussion The Chief Financial Officer & Section 95 Officer presented the report for information. This report provides Audit Committee with a summary of the Local Government Budgets 2025/26 report which was published by Audit Scotland in May 2025 and is appended to this report. The Chief Financial Officer & Section 95 Officer advised it is standard practice to bring documents of national interest to the attention of the Audit Committee. The five main messages in the report are in connection with Scottish Government funding, rising costs and the increasing demand on Councils to find local solutions to budget gaps, transparency of the presentation of budget information and community engagement as part of budget processes. The Committee will already be familiar with the solutions found by Midlothian Council to these challenges, and responses from other Local Authorities are provided for reference. The Chair thanked the Chief Financial Officer & Section 95 Officer for the report and opened it up for questions. The Committee pointed out the numbers from Scottish Government and other Local Authorities are not adjusted for inflation and wondered whether this had been taken into consideration by the Convention of Scottish Local Authorities (COSLA) or another body. The Chief Financial Officer/Section 95 Officer advised the Council does not automatically increase those figures for inflation on an annual basis but occasionally grants received from Government are increased, as was the case in February 2025. Decision The Audit Committee noted the recommendations in the report. Report No. Report Title Submitted by: 5.5 Internal Audit Work to May 2025 Chief Internal Auditor Outline of report and summary of discussion The Chief Internal Auditor presented the report for decision, providing members of the Audit Committee with details of the recent work carried out by Internal Audit, the Page 11 of 128
Page 12
findings and recommended audit actions agreed by Management to improve internal controls and governance arrangements. The Audit Committee is recommended to: (a) Consider the Executive Summary of the final Internal Audit Assurance Report issued associated with the delivery of the approved Internal Audit Annual Plan 2024/25; (b) Note the Internal Audit Consultancy and Other Work carried out in accordance with the approved Internal Audit Charter; and (c) Acknowledge the assurance provided on internal controls and governance arrangements in place for the areas covered by this Internal Audit work. An Executive Summary of the final Internal Audit Assurance Report issued, including audit objective, findings, good practice and recommendations (where appropriate), and the Chief Internal Auditor’s independent and objective opinion on the adequacy of the control environment and governance arrangements within each audit area is shown in Appendix 1. The Chief Internal Auditor highlighted a number of internal reports, noting there is an executive summary in the following pages of the report: • SEEMiS (Scottish Education Establishments Management Information System) providing reasonable assurance (summary in page 121 of report) • IT Asset Management providing limited assurance (page 132) • Education Construction Governance providing reasonable assurance (page 127) • Revenue Financial Budget providing reasonable assurance (page 139) SEEMiS is a system used by all Scottish Councils. The view is that SEEMiS is generally secure but there was a concern identified in connection with former staff members still having access. As a result of this audit system access control is to be adjusted. The key findings of the IT Asset Management Audit note a lack of process for reconciling assets with purchase orders and no payments made to the asset management disposal contractor management. Several recommendations were made to service managers for implementation. The Chief Internal Auditor added that there were material variances in the budget monitoring for Adult Health and Social Care Services. Budget monitoring processes report material variances in Adult Social Care Services. These are not currently included within the Council reports but they are regularly reported to the Midlotian Integrated Joint Board. As of the 2025-2026 financial year these will be part of the Council Internal Audit Work The Chair thanked the Chief Internal Auditor for their report and opened for questions. The Committee noted the report highlights some deficiencies in Council Tax control and Council Tax refund monitoring of refunds. Considering the recent fraud uncovered at Aberdeen City Council the Committee asked when Internal Audit last Page 12 of 128
Page 13
conducted a review of Council Tax. The Chief Internal Auditor explained that the matter of Council Tax will be covered in item 5.6 but advised that the findings in relation to Council Tax refunds suggest that procedural control is strong, however the system control for segregation of duties was not robust enough, and that has now been addressed following input from Internal Audit. The Chair noted that the headlines on page 141 state that the conclusion for Objective 4 - Revenue Budget Monitoring Reporting for Elected Member; and senior management level is adequate shows as “Limited” and asked for clarification on whether this means limited assurance or limited access to information. The Chief Internal Auditor referred to page 116 of the meeting papers which provides the definition for each category. The Chief Internal Auditor confirmed that there is limited assurance in connection with Revenue Budget Monitoring, that improvement is required, and monitoring is reviewed on a quarterly basis. Decision The Audit Committee approved the recommendations set out in the report. Report No. Report Title Submitted by: 5.6 Council Tax Refunds Control Assurance Review Chief Internal Auditor Outline of report and summary of discussion The Chief Internal Auditor presented the report for information. Following receipt of a letter from the Chair of the Accounts Commission the Chief Executive of Midlothian Council requested that Internal Audit review the areas indicated in the letter against the processes for payment of Council Tax refunds in Midlothian Council. The letter was sent to all Scottish Local Authority Chief Executives on the 10 January 2025 and is included as appendix to the report. As noted in previous items this Internal Audit was requested following uncovering of evidence of significant Council Tax fraud in Aberdeen City Council. The Internal Audit was completed in June 2025 and concludes that the Council has good procedural controls in place, however there is evidence that compliance with these controls is not always being monitored and is not supported by appropriate systems controls for segregation of duties. Subsequent sample testing identified no evidence of fraud within the 2024/25 financial year. The Chief Internal Auditor advised the main recommendation was to refresh counter fraud policies. The Chair thanked the Chief Internal Auditor for their report and opened for questions. There were no questions presented by the Committee, and the recommendations in the report were noted. Decision The Audit Committee noted the contents of the report. Page 13 of 128
Page 14
Report No. Report Title Submitted by: 5.7 Internal Audit Assurance Report 2024/25 Chief Internal Auditor Outline of report and summary of discussion The Chief Internal Auditor presented the report for decision. The report presents Audit Committee with the Internal Audit Annual Assurance Report for the year to 31 March 2025 which includes the Chief Internal Auditor’s independent assurance opinion on the adequacy of Midlothian Council's overall control environment. The Public Sector Internal Audit Standards (PSIAS) require that the Chief Audit Executive, the Council’s Chief Internal Auditor, provides an annual Internal Audit opinion and report on the adequacy and effectiveness of the Council’s governance, risk management and internal controls to support the preparation of the Annual Governance Statement. This is in support of the overall governance arrangements of the Council, as set out in the Local Code of Corporate Governance. To meet the requirements of the PSIAS, the Internal Audit Annual Assurance Report 2024/25 (Appendix 1) includes the Chief Internal Auditor’s annual opinion on page 184, which provides details of the Internal Audit activity and the performance during the year to fulfil its role, and summarises the outcomes of assessments of the Internal Audit service against the PSIAS. The Chief Internal Auditor advised their report states the systems of internal control and risk management, and governance are generally adequate. Improvements are required for the internal control environment in relation to business continuity, service risk management, IT asset management, assets management and revenue financial monitoring, procurement and contract management, all of which need to be completed against the challenging financial environment. Finally report section 4.3 notes the recommendations the Internal Audit team need to take forward as the result of the external quality assessment which is in section 5. The Chair thanked the Chief Internal Auditor for their report and opened for questions. There were no questions. The report was moved by Councillor McCall and seconded by Councillor Bowen Decision The Audit Committee approved the recommendations set out in the report. Page 14 of 128
Page 15
Report No. Report Title Submitted by: 5.8 Counter Fraud Annual Report 2024/25 Chief Internal Auditor Outline of report and summary of discussion The Chief Internal Auditor presented the report for decision, making the Audit Committee aware of the Council’s counter fraud responsibilities, the activities of the Integrity Group and Corporate Fraud Team in liaison with other services over the past year as part of the arrangements to tackling fraud at the Council. Having robust fraud prevention and investigation arrangements in place contributes to safeguarding the Council’s resources for delivery of services, as part of protecting the public purse. The Counter Fraud Strategy approved by the Council on 25 August 2020 includes: a focus on enhancing fraud prevention and detection to improve Midlothian Council’s resilience to the risk of fraud, theft, corruption and crime; and ensure these are embedded preventative practices. Assurances about the effectiveness of the Council’s existing systems and arrangements for tackling fraud can be taken from the outcomes contained within this report. The Chief Internal Auditor highlighted that as part of the Fraud Team’s work with other teams and following Audit Scotland’s advice, savings of £906,713 pounds have been made during 2024-25. The savings are detailed in appendix 1. The figure reported as part of internal corporate fraud recovery is £45,413. The savings accrued from properties where official tenants were residing elsewhere amount to £861,300 and furthermore this has meant that the 11 properties vacated have allowed Housing Services to offer homes to 11 families on the waiting list. Appendix 2 highlights remaining savings obtained through matches in the National Fraud Initiative exercise 2022-23. For the cases involving Single Person Council Tax Discount, these are considered through the Council Tax Reduction Scheme, while the other ones are based on assessments from the National Fraud Initiative. The Chair thanked the Chief Internal Auditor for their report and expressed congratulations to the Housing Team’s work in identifying instances of fraud. The Chair opened the report for questions. The Committee queried whether fraud related to disability Blue Badges falls within the scope of the National Fraud Initiative. The Chief Internal Auditor advised a series of matches through the National Fraud Initiative exercise came from the Department of Work and Pensions. A large majority of these were cases where a Blue Badge was taken off fraudulent claimants who were using them after the original recipient moved out of the area or passed away. The Committee asked whether Midlothian Council has a whistleblowing facility to allow residents to report fraud concerns to the Council. The Chief Internal Auditor advised there is a whistleblowing phoneline and a functionality on the Council’s website to report anonymously and non-anonymously. Midlothian Council encourages anyone with concerns to report them to the Fraud Team. The report was moved by Councillor McCall and seconded by Councillor Bowen. Page 15 of 128
Page 16
Decision The Audit Committee approved the recommendations set out in the report. Report No. Report Title Submitted by: 5.9 External Quality Assessment of Midlothian Council’s Internal Audit Service Chief Internal Auditor Outline of report and summary of discussion The Chief Internal Auditor presented the report for information, introducing the External Quality Assessment of Midlothian Council’s Internal Audit Service recently completed by Michelle Blair, Chief Auditor East Renfrewshire Council. The report is included as Appendix 1. The Audit Committee is asked to note the External Quality Assessment of Midlothian Council’s Internal Audit Service recently completed by Michelle Blair, Chief Internal Auditor, East Renfrewshire Council. This is a requirement which Local Authorities should complete every 5 years; however, this has been delayed by two years due to the COVID pandemic and further challenges related to shared service implementation. The Chief Internal Auditor of East Renfrewshire Council advised that this is the last report completed under the PSIAS arrangement as it was replaced by the Global Internal Audit Standards (GIAS) in April 2025 which provides the same level of compliance. The Audit covers 14 separate areas, of which Midlothian was shown as conforming in 8 areas, and generally conforming in the remaining 6 areas. The overall conclusions are on page 210 and the summary bullet points suggest areas for improvement. The Chief Internal Auditor of East Renfrewshire Council noted the Internal Audit Team is very qualified, high performing, and has a significant level of compliance across all areas considered and thanked the stakeholders for their cooperation. The Chair thanked the Chief Internal Auditor for their report and opened for questions. As there were no questions the Audit Committee noted the contents of the report. Decision The Audit Committee noted the contents of the report. Page 16 of 128
Page 17
Report No. Report Title Submitted by: 5.10 Draft Annual Governance Statement 2024/25 Chief Executive Outline of report and summary of discussion The Chief Executive presented the report for decision, proposing that the Audit Committee considers and approves the draft Annual Governance Statement that will be published in the Council’s Statement of Accounts 2024/25. Section 4 in the report outlines the assurance process followed, while appendix 1 contains the assurance statement. Five areas for improvement were identified in the report, namely: • Financial sustainability • Procurement capacity • Capital plan affordability • Need to update service level risk registers and business continuity plans • Need to update Council Tax refund monitoring processes, which is currently in the process of being addressed with the system supplier. The improvements recommended are in page 239-240 of the meeting papers. Section 4.6 of the report is the Chief Executive’s statement which provides adequate assurance on matters of control, governance and assurance that the local code is being complied. There are also adequate internal control systems in place. This report has two recommendations: • Consider the details of the Draft Annual Governance Statement • Approve the report’s publication as part of the Council’s statement of accounts. The Chair thanked the Chief Executive for the report and opened for questions. The Committee asked whether Midlothian Council were invited to make a statement regarding Midlothian Integration Joint Board governance given the limited control. The Chief Executive advised this was out with the scope of the report, but effort will be made to improve the Council’s ability to report on the Midlothian Integration Joint Board’s finances and include information on their governance in reports going forward. The Audit Committee agreed to both recommendations. The report was moved by Councillor McCall and seconded by Councillor Bowen. Decision The Audit Committee approved the recommendations set out in the report and to its publication. Page 17 of 128
Page 18
Report No. Report Title Submitted by: 5.11 Strategic Risk Profile Quarter 4, 2024-25 Chief Officer Place Outline of report and summary of discussion The Chief Officer Place presented the report for information, providing Audit Committee with an update on the risk landscape and the Council’s organisational response including the most significant risks of quarter 4 of the financial year 2024- 2025 (1st Jan to 31st March 2025). Council is asked to note the contents of the report. Audit Committee is recommended to note there are no new risks in the Risk Register but there are new mitigating actions to mitigate the existing risks in the register. Key aspects of Quarter 4 are mitigating strategies for climate change as work has commenced on a new Climate Change Strategy following the Council approving a new target to achieve net zero by 2045. A new Economic Strategy for Inclusive Growth has stimulated work on delivery plans which will be presented to June council. Council also approved the Workforce Strategy and received an update on Capital Plan Prioritisation in February 2025. The Chair thanked the Chief Officer Place for their report and opened for questions. Elected Members thanked the Chief Officer Place for the report and asked how the Strategic Risk Profile can respond to unknowns and unlikely scenarios such as restrictions on water usage resulting from the dry weather in May 2025. The Chief Officer Place advised that in terms of risk management, several factors are considered to plan mitigating actions. When faced with unique and unprecedented events such as the COVID pandemic, there are no plans despite a clear need to respond timeously. The consequences of dry weather on water management are covered under climate response to ensure the Council can respond to the needs of communities. Decision The Audit Committee noted the contents of the report. 6. Private Reports No items for discussion. 7. Date of Next Meeting The meeting concluded at 11.58 am. The next meeting of the Audit Committee will be held on Tuesday 30 September 2025 at 11:00am. Page 18 of 128
Page 19
Audit Committee Tuesday 30 September 2025 Item 4.2 Audit Committee Action Log No Date of Meeting Item No and Title Action Action Owner Expected completion date Comments 1 16 June 2025 4.1 Minute of Audit Committee Meeting of 24 February 2025 Review the list of attendees at 24 February 2025 Audit Committee as detailed on the minute, and correct where required. Democratic Services 30 September 2025 Recommended for closure. The webcast of 24 February 2025 Audit Committee Meeting was reviewed and the attendees listed on the minute of the meeting, which was included in the agenda pack for 16 June 2025 for approval, was verified as the correct record. Page 19 of 128
Page 20
Page 20 of 128
Page 21
Audit Committee Tuesday 30 September 2025 Item No 5.1 Audit Committee – Nomination of Chair Report by Saty Kaur, Chief Officer Corporate Solutions Report for Decision 1 Recommendations Audit Committee is recommended to: Nominate an Elected Member from the Audit Committee to the role of Chair. 2 Purpose of Report/Executive Summary The purpose of this report is to seek nomination for an Elected Member from the Audit Committee to the role of Chair. Date Wednesday 17 September 2025 Report Contact: Saty Kaur, Chief Officer Corporate Solutions Saty.Kaur@midlothian.gov.uk Page 21 of 128
Page 22
3 Background/Main Body of Report 3.1 The Audit Committee comprises 5 Elected Members. Councillor Douglas Bowen Councillor Debbi McCall Councillor Willie McEwan Councillor Derek Milligan Councillor Peter Smaill 3.2 In 2022, the Audit Committee agreed an annual rolling programme of Chair, until September 2025. Audit Committee are now asked to consider the appointment of Chair until the Local Government Elections in May 2027. 3.3 The Committee remit includes: Statement of purpose 1. The Audit Committee is a key component of Midlothian Council’s corporate governance. It provides an independent and high-level focus on the audit, assurance and reporting arrangements that underpin good governance and financial standards. 2. The purpose of the Audit Committee is to provide independent assurance to elected members of the adequacy of the risk management framework and the internal control environment. It provides independent review of Midlothian Council’s governance, risk management and control frameworks and overseas the financial reporting and annual governance processes. It oversees internal and external audit, helping to ensure efficient and effective assurance arrangements are in place. Governance, risk and control 3. To review the Council’s corporate governance arrangements against the good governance framework and consider annual governance reports and assurances, relating to the Council’s service delivery models including partnership and collaboration, to ensure that the highest standards of probity, public accountability and ethical standards are demonstrated. 4. To review the Annual Governance Statement prior to approval and consider whether it properly reflects the risk environment and supporting assurances, taking into account Internal Audit’s opinion on the overall adequacy and effectiveness of the Council’s framework of governance, risk management and control. 5. To consider the Council’s arrangements to secure value for money and review assurances and assessments on the effectiveness of these arrangements. 6. To consider the Council’s framework of assurance, relating to the Council’s service delivery models including partnership and Page 22 of 128
Page 23
collaboration, and ensure that it adequately addresses the risk and priorities of the Council. 7. To monitor the effective development and operation of risk management in the council relating to the Council’s service delivery models including partnership and collaboration. 8. To monitor progress in addressing risk-related issues reported to the committee. 9. To consider reports on the effectiveness of internal controls and monitor the implementation of agreed actions. 10.To review the assessment of fraud risks and potential harm to the council from fraud corruption. 11.To monitor the counter-fraud strategy, actions and resources. 12.To monitor controls operating over Treasury Management, through the scrutiny of the Treasury Management Strategy, mid-term and annual performance reports prior to their presentation to Council for approval, and the Council’s approach to establishing ethical standards. Internal audit 13.To approve the Internal Audit Charter. 14.To review proposals made in relation to the appointment of external providers of Internal Audit services and to make recommendations. 15.To approve the risk-based internal audit plan, including internal audit’s resources requirements, the approach to using other sources of assurance and any work required to place reliance upon those other sources. 16.To approve significant interim changes to the risk-based internal audit plan and resource requirements. 17.To make appropriate enquiries of both management and the Chief Internal Auditor to determine if there are any inappropriate scope or resource limitation. 18.To consider reports from the Chief Internal Auditor on Internal Audit’s performance during the year, including the performance of external providers of Internal Audit services. These will include: a. Updates on the work of Internal Audit including key findings, issues of concern and action in hand as a result of internal audit work. b. Regular reports on the results of the Quality Assurance and Improvement Programme. c. Reports on instances where the internal audit function does not conform to the Public Sector Internal Audit Standards and Local Government Application Note, considering whether the non- Page 23 of 128
Page 24
conformance is significant enough that it must be included in the Annual Governance Statement. 19.To consider the Chief Internal Auditor’s annual report: d. The statement of the level of conformance with the Public Sector Internal Audit Standards and Local Government Application Note (including code of ethics) and the results of Assurance and Improvement Programme that supports the statement – these will indicate the reliability of the conclusions of internal audit. e. The opinion on the overall adequacy and effectiveness of the Council’s framework of governance, risk management and control together with the summary of the work supporting the opinion - these will assist the committee in reviewing the Annual Governance Statement. 20.To consider summaries of specific Internal Audit reports as requested. 21.To receive reports outlining the action taken where the Chief Internal Auditor has concluded that management has accepted a level of risk that may be unacceptable to the authority or there are concerns about progress with the implementation of agreed actions. 22.To contribute to the Quality Assurance and Improvement Programme and in particular, to the external quality assessment of Internal Audit that takes place at least once every five years. 23.To consider a report on the effectiveness of Internal Audit to support the Annual Governance Statement. 24.To support the development of effective communication with the Chief Internal Auditor. External audit 25.To consider the external auditor’s annual letter, relevant reports, and the report to those charged with governance. 26.To consider specific reports as agreed with the external auditor. 27.To comment on the scope and depth of external audit work and to ensure it gives value for money. 28.To commission work from internal and external audit. 29.To advise and recommend on the effectiveness of relationships between external and internal audit and other inspection agencies or relevant bodies. Financial Reporting 30.To review the annual statement of accounts. Specifically, to consider whether appropriate accounting policies have been followed and Page 24 of 128
Page 25
whether there are concerns arising from the financial statements or from the audit that need to be brought to the attention of the Council. 31.To consider the external auditor’s report to those charged with governance on issues arising from the audit of the accounts. Accountability arrangements 32.To report to those charged with governance on the committee’s findings, conclusions and recommendations concerning the adequacy and effectiveness of their governance, risk management and internal control frameworks; financial reporting arrangements, and internal and external audit functions. 33.To report to full Council on a regular basis on the committee’s performance in relation to the terms of reference and the effectiveness of the committee in meeting its purpose. Meetings The Council will decide on the schedule of meetings for the Audit Committee, usually on a rolling annual basis which will be published. Quorum The quorum for meetings of the Audit Committee will be 3 Members, which may include the Independent Chair (when appointed). Minutes The Minutes of the Audit Committee will be recorded by the Officer clerking the meeting and submitted to the next ordinary meeting of the Committee for approval. They will also be submitted to the Council both for information and to allow the Council to consider any recommendations contained in them. Meetings of the Audit Committee will also be audio cast subject to the exemptions contained within the Local Government (Scotland) Act 1973. Private items of any meeting agenda will be recorded and the recording retained by Democratic Services which will be accessible to all Elected Members and relevant Officers for 12 months from the date of the meeting. Page 25 of 128
Page 26
4 Report Implications (Resource, Digital and Risk) 4.1 Resource No implications 4.2 Digital No implications 4.3 Risk Failure to nominate a member means the Council is not following its Standing Orders and Scheme of Administration. 4.4 Ensuring Equalities (if required a separate IIA must be completed) No implications 4.4 Additional Report Implications (See Appendix A) See Appendix A Page 26 of 128
Page 27
APPENDIX A – Report Implications A.1 Key Priorities within the Single Midlothian Plan N/A A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious None of the above A.4 Delivering Best Value N/A A.5 Involving Communities and Other Stakeholders N/A A.6 Impact on Performance and Outcomes N/A A.7 Adopting a Preventative Approach N/A A.8 Supporting Sustainable Development N/A Page 27 of 128
Page 28
Page 28 of 128
Page 29
Audit Committee Tuesday 30 September 2025 Item No 5.4 Internal Audit Work to September 2025 Report by Chief Internal Auditor Report for Decision 1 Recommendations The Audit Committee is asked to: a) Consider the Executive Summary of the final Internal Audit assurance report issued associated with the delivery of the approved Internal Audit Annual Plan 2025/26; b) Note the Internal Audit Consultancy and Other Work carried out in accordance with the approved Internal audit Charter; and c) Acknowledge the assurance provided on internal controls and governance arrangements in place for the areas covered by this Internal Audit work. 2 Purpose of Report/Executive Summary The purpose of this report is to provide members of the Audit Committee with details of the recent work carried out by Internal Audit and the findings and recommended audit actions agreed by Management to improve internal controls and governance arrangements. The Internal Audit Annual Plan 2025/26 was approved by the Audit Committee on 24 February 2025. Internal Audit has carried out work associated with the delivery of the plan to meet its objective of providing an opinion on the efficacy of the Council’s risk management, internal control and governance. An Executive Summary of the final Internal Audit assurance report issued, including audit objective, findings, good practice and recommendations (where appropriate), and the Chief Internal Auditor’s independent and objective opinion on the adequacy of the control environment and governance arrangements within each audit area is shown in Appendix 1. The Internal Audit function conforms to the professional standards as set out in Global Internal Audit Standards (GIAS) including the production of this report to communicate the results of the reviews. Date 16 September 2025 Report Contact: Duncan Stainbank duncan.stainbank@midlothian.gov.uk Page 29 of 128
Page 30
2 3 Progress Report 3.1 The Internal Audit Annual Plan 2025/26 was approved by the Audit Committee on 24 February 2025. Internal Audit has completed the following work in the period from 31 May 2025 to 17 September 2025 associated with the delivery of the plan to meet its objective of providing an opinion on the efficacy of the Council’s risk management, internal control and governance. 3.2 The Internal Audit function conforms to the professional standards as set out in Global Internal Audit Standards (GIAS), including the production of this report to communicate the results. 3.3 Internal Audit issued a final assurance report on the following subjects: • Recruitment and Use of Agencies. 3.4 An Executive Summary of the final Internal Audit assurance report issued including audit objective conclusions, key findings, recommendations, areas of good practice, the Chief Internal Auditor’s independent and objective opinion on the adequacy of the control environment and governance arrangements within each audit area is shown in Appendix 1. 3.5 The definitions for Internal Audit assurance categories are as follows: Level Definition Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Internal Audit Consultancy and Other Work 3.6 Internal Audit staff have been involved in the following for the Council to meet its aims and objectives, and its roles and responsibilities in accordance with the approved Internal Audit Charter and Strategy: a) In its critical friend role provided an independent view and challenge at various forums including: Capital Plan and Asset Management Board, Chief Officers Risk & Resilience Group, and the Integrity Group. b) Learning and development during the research stage of new audit areas for all Internal Audit team members and through joining audit forums (Computer Audit Sub-group) and meetings; and c) Monitored publication of Audit Scotland reports. Page 30 of 128
Page 31
3 Recommendations 3.7 Recommendations in reports are suggested changes to existing procedures or processes to improve the controls or to introduce controls where none exist. The grading of each recommendation reflects the risk assessment of non-implementation, being the product of the likelihood of the risk materialising and its impact: High Recommendations relating to factors fundamental to the success of the control objectives of the system. The weaknesses may give rise to significant financial loss/misstatement or failure of business processes. Medium Recommendations which will improve the efficiency and effectiveness of the existing controls. Low Recommendations concerning minor issues that are not critical, but which may prevent attainment of best practice and/or operational efficiency. Outwith the report, Internal Audit informs operational managers about other matters as part of continuous improvement. 3.8 The table below summarises the number of Internal Audit recommendations made during 2025/26: Recs Rating 2025/26 Number of Recs High 0 Medium 9 Low 13 Not Graded 0 Sub-total reported this period 22 Previously reported 0 Total 22 Recommendations agreed with action plan 22 Not agreed; risk accepted 0 Total 22 4 Report Implications (Resource, Digital, Risk and Equalities) 4.1 Resource Resource implications of implementing Internal Audit recommendations are considered as part of the audit process to ensure these are reasonable and proportionate to the risks. 4.2 Digital There are no digital implications arising from this report. Page 31 of 128
Page 32
4 4.3 Risk The GIAS require Internal Audit to evaluate the effectiveness of the Council’s Risk Management arrangements and contribute to improvements in the process. At the start of each audit engagement, to capture potential areas of risk and uncertainty more fully, key stakeholders have been consulted and risk registers have been considered. During each audit engagement the management of risk has been tested. It is anticipated that improvements in the management and mitigation of risks will arise as a direct result of Management implementing the Internal Audit recommendations made. If audit recommendations are not implemented, there is a greater risk of financial loss and/or reduced operational efficiency and effectiveness, and Management may not be able to demonstrate improvement in internal control and governance arrangements, and effective management of risks. 4.4 Ensuring Equalities This report does not relate to a new or revised policy, service or budget change, which affects people (the public or staff), so an Integrated Impact Assessment (IIA) is not an applicable consideration. The Internal Audit work is carried out in accordance with the appropriate legislation and professional standards. The latter includes compliance by those within the Internal Audit function with the ethical requirements set out in the GIAS which is appropriate for the profession of Internal Audit founded as it is on trust placed in its independent and objective assurance about risk management, internal control and governance. 4.5 Additional Report Implications (See Appendix A) Page 32 of 128
Page 33
5 APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan to which Midlothian Council and its Community Planning Partners have made a commitment (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change), good governance is important to enable Midlothian Council to deliver its key priorities in support of achieving the Council’s objectives. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above Midlothian Council is committed to creating a great place to grow supported by the 9 drivers for change. Implementing the 9 drivers for change in practice is applicable to the Council’s Internal Audit service provision to assist the Council in achieving its objectives. A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value Implementation by Management of the actions associated with Internal Audit recommendations, that are designed to improve internal control and governance arrangements and management of risks, underpins the Council’s own continuous improvement arrangements to enhance its effectiveness, thus supporting the delivery of the Council’s best value duties. A.5 Involving Communities and Other Stakeholders The Chief Internal Auditor is accountable to the Audit Committee which, in fulfilling its governance role, acts as a bridge between the Council and other stakeholders. Page 33 of 128
Page 34
6 This report has been presented to Senior Management relevant to the areas audited and have agreed the final Internal Audit assurance reports as set out in the relevant Executive Summary within Appendix 1. A.6 Impact on Performance and Outcomes The Findings and Recommendations from Internal Audit work during the year are designed to assist the Council in improving its performance and outcomes. A.7 Adopting a Preventative Approach Internal Audit assurance work includes assessments on when a preventative approach can be adopted. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Good governance is important to enable Midlothian Council to achieve its objectives. Page 34 of 128
Page 35
Appendix 1. Executive Summary: Recruitment & Use of Agencies Conclusion: Limited Assurance Policies and procedures have been established to support the recruitment process and the Council’s use of agencies. Digital workflows have been developed to support the recruitment authorisation and onboarding processes and systems are in place to support managers with the selection and shortlisting process. However, it was identified that there is high usage of agency suppliers that are not on any Council approved public sector framework, a lack of ongoing review by DMT of agency workers, inaccuracies of the off-payroll establishment in iTrent, an agency worker policy that does not operate as described, the audit trail between the digital workflow for post authorisation and the staffing authorisation spreadsheet taken to DMT for approval is weak and inadequate monitoring arrangements for the application of the Recruitment and Selection Policy and the Policy on the Use of Agency Workers. Background The purpose of the audit was to review the processes in place to ensure that recruitment is completed effectively and protects the Council from the risk of employment of inappropriate or unqualified employees or agency workers, whilst meeting legislative requirements. Employment and Reward (E&R) manage the design, delivery, and operation of recruitment, operate payroll processes ensuring compliance with relevant regulatory, statutory and legislative provisions, and are responsible for the interpretation and implementation of legislation and regulation in relation to PAYE and other statutory requirements. The team work closely with the Human Resources (HR) team to ensure the appropriateness and effective implementation of a range of People Policies and procedures. System support is provided by the Business Applications Team. The iTrent HR & Payroll System is used for the Council’s payroll, absence management, and HR functions and the Talentlink system (provided by COSLA) is used to support the application and shortlisting process. Personnel documentation is held in Opentext CS23 and digital workflows have been developed to support the recruitment process using this application. Summary of key findings and recommendations The following findings and recommendations are highlighted, which have all been agreed by Management: Approximately £3million (38%) per annum of agency spend across a number of services are with suppliers who are not on any approved public sector framework. Management will liaise with the Procurement Team and over time substantially reduce the level of non-framework agency suppliers used by 30 September 2026. The off-payroll establishment in iTrent includes 79 off-payroll workers who have left the Council and 17 agency workers who are currently working with the Council but have not been added to the iTrent system. Management will review and update the iTrent off-payroll establishment and review why the agency workers identified have not been added to iTrent by 31 December 2025. The audit trail between the digital workflow for post authorisation and the staffing authorisation spreadsheet taken to DMT for approval is weak. Management will review and strengthen the arrangements for this by 31 October 2025 and the iTrent upgrade (if agreed subject to funding) has intentions to review existing and improve processes around control of posts and positions aligned to budget monitoring by 30 September 2026. The list of agency workers for each directorate is not formally presented to DMTs for ongoing authorisation as required by the current policy. The directorate listing of all agency staff should periodically be presented to relevant DMTs for review in line with the policy by 31 December 2025. Clear written principles have not been established for managers to follow on when a level 1 disclosure check is required. Guidance will be prepared that details principles for all managers to follow on when a basic level 1 disclosure check is required by 31 March 2026. Page 35 of 128
Page 36
2 The processes and controls detailed in the Policy on the Use of Agency Workers are not operating as described. The Recruitment and Selection Policy has not been updated since 2012 and is out-of-date in a number of respects including how the policy is monitored, legislation, best practice, and the Council’s organisational structure. Management are in the process of reviewing the Recruitment and Selection Policy and will present a revised policy for Trade Union consultation and formal approval by 31 December 2025. Recommendations Grade High Medium Low Total Current Report - 9 13 22 Prior Report - N/A - - - - Materiality - The Council’s annual payroll expenditure including employer’s national insurance and employer’s pension contributions was £203,133,207 in 2024/25 and £199,303,547 in 2023/24. The Council’s agency spend was £7,818,199 in 2024/25 and £8,006,288 in 2023/24. Page 36 of 128
Page 37
3 Headlines Objectives Conclusion Comments 1. Recruitment and Agency Worker policies and procedures are in place and training is provided / monitoring undertaken to ensure these are complied with. Limited Assurance A Recruitment and Selection Policy is in place; however, the policy has not been updated since 2012 and is out-of-date in a number of respects including references to how the policy is monitored, legislation, best practice, and the Council’s organisational structure. HR have monitoring arrangements in place for the appointment of senior officers and typically will form part of the recruitment panel for these roles however, there is no periodic monitoring on a sample basis for other roles. No training is provided to managers over the recruitment process other than the training Business Applications provides on the use of the Talentlink system - HR have advised that training can be provided on request and written guidance is available. The Policy on the Use of Agency Workers was updated in 2019 however it could not be established when the policy was approved. The processes detailed in the policy for the ongoing authorisation of agency workers are not operating as described in practice (ongoing authorisation is not given by DMT and periodic reporting of agency workers is not in place), and the policy mentions a conversion process to fixed term contracts after 12 weeks for agency workers but lacks detail on how that process should work in practice. 2. New posts are appropriately authorised prior to recruitment and advertisement. Reasonable Assurance A digital workflow has been developed which provides an audit trail of the post authorisation of the manager and the subsequent post authorisation by DMT. Posts are not advertised until they are authorised. Segregation of duties is in place with the workflow being first authorised by the recruiting manager, DMT authorisation, and then the workflow is updated following DMT by a Personal Assistant (PA) to the Chief Officer or Director. Financial Services receive details of all posts due to be approved at DMT and regularly attend DMT and advise whether a budget is in place for the proposed posts. However, only the Children, Young People and Partnerships Directorate include the workflow unique identification numbers in the new post staffing spreadsheet taken to DMT for approval; including this strengthens the audit trail. The staffing structure in the iTrent system contains many obsolete posts; it has been advised that this is due to be addressed by the forthcoming iTrent project. Page 37 of 128
Page 38
Objectives Conclusion Comments 3. Applications are completed, shortlisting and interviews of candidates are undertaken in accordance with procedures and appropriately documented for each vacancy Reasonable Assurance Appropriate processes are in place for reviewing applications and manager shortlisting which is supported by the Talentlink system. Shortlisting decisions and employee applications are held in the Talentlink system. There is guidance on the intranet for strength-based interviewing which in the past required all recruiting managers to sign that they have read and understood the guidance, but this check is no longer being completed by managers or monitored by HR and does not form part of the recruitment pack issued to managers. From 23 cases reviewed, on 9 occasions an interview template was used that was a competency / job role-based interview and not a strength-based interview in line with the Council's issued guidance. Applicant shortlisting information must be retained for 6 months from the date that recruitment has been finalised. However, this requirement is not included in the recruitment pack issued to recruiting managers. Testing identified that on 7 out of 23 occasions, the manager had shredded all of the interview related documentation either after the candidate selection or following the start of the new employee. 4. Pre-employment checks including verification of qualifications, background checks and reference verifications are completed, and onboarding processes are complied with. Limited Assurance The recruiting manager is responsible for confirming documents and collating all of the information for submission to E&R as part of the onboarding workflow. E&R have not adequately enforced the requirement for managers to confirm that they have seen the original documentation in all cases. From a sample of 26 employees, only for 5 employees were key documents such as passport, driving licence, and qualifications signed by Midlothian officers indicating that they have seen the original documents; a Right to Work (RTW) check was not completed for 1 employee; and for 1 employee only 1 reference was obtained (the requirement is 2 references for external candidates). The employer reference template could be improved. Recruiting managers appropriately obtain PVGs when required, but consistent processes are not in place for managers to follow detailing when a level 1 disclosure check is required. 5. Appropriate pre- employment checks are completed for all agency workers and the use of agency workers are monitored to ensure the Council is receiving best value and not creating any additional commitments. Limited Assurance The Council’s use of agency workers has increased significantly from £3.1m in 2019/20 to £7.8m in 2024/25. The Agency workers for each directorate are not formally presented to DMTs for ongoing authorisation (as required by the policy), only for initial authorisation, and periodic reporting is not in place. A workflow has been developed for recruiting managers to confirm every 3 months that the agency worker is still with the Council, that they are still required, and to re-confirm the IR35 status of the worker. 7 agency workers were noted that have been with the Council for over 4 years; all of these workers are from the Place Directorate. A number of services were noted that have significant agency spend from suppliers that are not on any approved public sector framework. The off-payroll establishment in iTrent includes 79 workers who have left the Council, but their leaving date has not been added to iTrent. Internal Audit identified 17 agency workers who are currently working with the Council but are not on the iTrent system. Page 38 of 128
Page 39
5 Areas where expected controls are met/good practice No. Areas of Positive Assurance 1. Policies for Recruitment and Selection and Agency Workers are in place. 2 Some procedural guidance of what is required for recruitment is detailed on the workflow forms themselves and an information pack is submitted to recruiting managers when they start a new recruitment. 3. There is guidance available on the staff intranet in relation to strength-based interviewing. 4. Training is in place for the use of the Talentlink system. From the sample of applications reviewed, the decision made on Talentlink agreed to the staff member appointed. 5 A workflow has been developed which provides an audit trail of the post authorisation of the manager and the subsequent post authorisation by DMT. Posts are not advertised until they are authorised. 6 A workflow process has been developed for E&R to collect all relevant pre-employment data before a new employee starts with the Council. Most documents do appear to be collected before an employee starts with the Council. 8 A workflow is in place for the authorisation of agency staff. The workflow includes recruiting manager and DMT authorisation. 9 Processes have been developed for recruiting managers to confirm the IR35 status of agency workers as part of the onboarding and on an ongoing basis. 10. Adult Social care has substantially reduced agency spend from £2.2million in 2023/24 to £1.1 million in 2024/25 as a result of a review of safe staffing levels leading to a recruitment drive for permanent posts which has been very effective at reducing their agency usage. Page 39 of 128
Page 40
Recommendation Grading/Overall Opinion Definitions Recommendation Definition High Recommendations relating to factors fundamental to the success of the control objectives of the system. The weaknesses may give rise to significant financial loss/misstatement or failure of business processes. Medium Recommendations which will improve the efficiency and effectiveness of the existing controls. Low Recommendations concerning minor issues that are not critical, but which may prevent attainment of best practice and/or operational efficiency. Levels of Assurance Definition Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Page 40 of 128
Page 41
Audit Committee Tuesday 30 September 2025 Item No 5.5 Audit Committee Annual / End of Term Report 2024/25 Report by Chair of the Audit Committee Report for Decision 1 Recommendations The Audit Committee is asked to approve the Audit Committee Annual / End of Term Report 2024/25 (Appendix 1) and its self-assessments using the CIPFA Audit Committees Guidance (Appendices 2 and 3) and agrees that the Audit Committee Annual / End of Term Report 2024/25 should be presented to the Council. 2 Purpose of Report/Executive Summary The purpose of this report is to provide Members with the Audit Committee Annual / End of Term Report 2024/25, which sets out how the Audit Committee has performed against its remit and the effectiveness of the Audit Committee in meeting its purpose based on the annual self-assessments of the Committee against best practice and provides assurances to the Council. It is important that the Council’s Audit Committee fully complies with best practice guidance on Audit Committees to ensure it can demonstrate its effectiveness as a scrutiny body as a foundation for sound corporate governance of the Council. The Chartered Institute of Public Finance and Accountancy (CIPFA) Audit Committees Practical Guidance for Local Authorities and Police 2022 Edition (hereinafter referred to as CIPFA Audit Committees Guidance) includes the production of an annual report on the performance of the Audit Committee for submission to the Council. The Audit Committee Annual / End of Term Report 2024/25 is appended to this report as Appendix 1 for consideration. Date 15 September 2025 Report Contact on behalf of the Chair of the Audit Committee: Duncan Stainbank Tel No 01620 827353 duncan.stainbank@midlothian.gov.uk Page 41 of 128
Page 42
2 3 Background 3.1 It is important that the Council’s Audit Committee fully complies with best practice guidance on Audit Committees to ensure it can demonstrate its effectiveness as a scrutiny body as a foundation for sound corporate governance for the Council. 3.2 The Chartered Institute of Public Finance and Accountancy (CIPFA) issued an updated guidance note Audit Committees Practical Guidance for Local Authorities and Police 2022 Edition (hereinafter referred to as CIPFA Audit Committees Guidance). It incorporates CIPFA’s Position Statement: Audit Committees in Local Authorities and Police which sets out CIPFA’s view of the role and functions of an Audit Committee. 3.3 The CIPFA Audit Committees Guidance includes the production of an annual report on the performance of the Audit Committee against its remit for submission to the Council. 4 Audit Committee Annual / End of Term Report 2024/25 and Self- Assessments 4.1 The Audit Committee carried out self-assessments of Compliance with the Good Practice Principles Checklist and Evaluation of Effectiveness Toolkit from the CIPFA Audit Committees Guidance by completing questionnaires in 2024 a meeting was attended by most of the Audit Committee members in August 2025 to complete this years annual evaluation. The combined self-assessments are appended to this report as Appendix 2 (Good Practice Principles) and Appendix 3 (Effectiveness) for consideration. 4.2 The outcome of the self-assessments was a high degree of compliance against the good practice principles and an improving and medium degree of effectiveness. Improvements were identified focussing on activity to improve its effectiveness in fulfilling its role. In summary these are: Schedule a recruitment, selection and appointment process for independent members of the Audit Committee within the next year. Provide members with a location on the Council shared drives for full versions of the Internal Audit Reports to be placed to ensure that the members always have full access to all Internal Audit reports. Consideration should always be given to making sure any national reports presented to committee are only put forward with a Midlothian specific covering paper providing appropriate information on the elements relevant to Midlothian Council. A private meeting between the Audit Committee members and External Audit should be arranged during 2025. 4.3 The Audit Committee Annual / End of Term Report 2024/25 is appended to this report as Appendix 1 for consideration. Midlothian Council continues to adopt this best practice. It is designed both to provide assurance to full Council and to share lessons learned and areas of improvement. Page 42 of 128
Page 43
3 5 Report Implications (Resource, Digital, Risk and Equalities) 5.1 Resource The Council has provided support and resources to the Audit Committee throughout the year including a Democratic Services Officer as the Minute secretary. In terms of accountability and independence to ensure conformance with the Public Sector Internal Audit Standards (PSIAS) and prepare for the Transition to Global Internal Audit Standards from 1st April 2025, the Chief Internal Auditor reports functionally to the Audit Committee as outlined within the Internal Audit Charter. The Chief Internal Auditor facilitated the annual self-assessment process and the prepared the Audit Committee Annual / End of Term Report on behalf of the Chair. 5.2 Digital There are no digital implications arising from this report. 5.3 Risk The role of the Audit Committee includes the high-level oversight of the effectiveness of the Council’s systems of internal financial control, internal control and governance, including risk management. There is a risk that the Audit Committee does not fully comply with best practice guidance thus limiting its effectiveness as a scrutiny body as a foundation for sound corporate governance. The completion of the annual self-assessment and identification of improvement actions as evidenced through this Annual / End of Term Report will mitigate this risk. 5.4 Ensuring Equalities This report does not relate to a new or revised policy, service or budget change, which affects people (the public or staff), so an Integrated Impact Assessment (IIA) is not an applicable consideration. 5.5 Additional Report Implications (See Appendix A) Page 43 of 128
Page 44
4 APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan to which Midlothian Council and its Community Planning Partners have made a commitment (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change), good governance is important to enable Midlothian Council to deliver its key priorities in support of achieving the Council’s objectives. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above Midlothian Council is committed to creating a great place to grow supported by the 9 drivers for change. Self-assessment of the Audit Committee utilising best practice toolkits underpins its own continuous improvement to ensure that modern and sustainable governance arrangements are in place. A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value Self-assessment of the Audit Committee utilising best practice toolkits underpins its own continuous improvement to enhance its effectiveness as a scrutiny body as a foundation for sound corporate governance of the Council, thus supporting the delivery of the Council’s best value duties. Page 44 of 128
Page 45
5 A.5 Involving Communities and Other Stakeholders The Audit Committee in fulfilling its governance role acts as a bridge between the Council and other stakeholders. A.6 Impact on Performance and Outcomes The members of the Audit Committee have reflected on the performance and outcomes against the remit of the Committee through the completion of annual self-assessments. The identification of improvement actions as evidenced through the Audit Committee Annual / End of Term Report are designed to enhance its effectiveness as a scrutiny body as a foundation for sound corporate governance of the Council. A.7 Adopting a Preventative Approach Assurances received by the Audit Committee from Management, Internal Audit and External Audit set out the assessment of prevention and detection internal controls and governance arrangements. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Good governance is important to enable Midlothian Council to achieve its objectives. Page 45 of 128
Page 46
Page 46 of 128
Page 47
APPENDIX 1 MIDLOTHIAN COUNCIL AUDIT COMMITTEE ANNUAL/END OF TERM REPORT FROM THE CHAIR – 2024/25 This annual/end of term report has been prepared to inform the Midlothian Council of the work carried out by the Council’s Audit Committee during the year 2024/25. The content and presentation of this report meets the requirements of the CIPFA Audit Committees Practical Guidance for Local Authorities and Police 2022 Edition (hereinafter referred to as CIPFA Audit Committees Guidance) to report to full Council on a regular basis on the Committee’s performance in relation to the terms of reference and the effectiveness of the Committee in meeting its purpose. Meetings There were meetings of the Audit Committee 4 times during the financial year which included meetings on 24 June 2024, 30 September 2024, 25 November 2024 and 24 February 2025 to consider reports pertinent to the audit cycle and its terms of reference. Additionally at the start of the 2024/25 financial year a meeting has been held on the 16 June 2025. The Audit Committee is a key component of Midlothian Council’s corporate governance. It provides an independent and high-level focus on the audit, assurance and reporting arrangements that underpin good governance and financial standards. The purpose of the audit committee is to provide independent assurance to elected members of the adequacy of the risk management framework and the internal control environment. It provides independent review of Midlothian Council’s governance, risk management and control frameworks, and oversees the financial reporting and annual governance processes. It oversees internal and external audit, helping to ensure efficient and effective assurance arrangements are in place. The Audit Committee reviewed the draft Annual Governance Statement 2023/24 at its meeting on 24 June 2024, and for 2024/25 at its meeting on the 16 June 2025 in order to assess whether it properly reflects the risk environment and whether the content is consistent with its evaluation of the internal controls and governance arrangements based on evidence received during the year. The Audit Committee scrutinised the unaudited Annual Accounts 2024/25 of the Council at its meeting on 16 June 2025 and for a period until publication later in the month. It reviewed the final audited accounts for 2023/24 at its meeting on 25 November 2024, alongside the External Audit report on their annual audit 2023/24 to consider any concerns or improvements arising from the audit, prior to recommending to the Council that they be adopted. The Audit Committee scrutinised the Annual Report and Accounts of the Council at appropriate times in accordance with its terms of reference, which also includes the promotion of good governance, and financial and ethical standards. The Audit Committee approved the Internal Audit Charter, and the Internal Audit Strategy and Annual Plan. It monitored Internal Audit’s performance including progress against annual plan approving changes during the year, conformance with Public Sector Internal Audit Standards (PSIAS), which have been replaced by the Global Internal Audit Standards (GIAS) from April 2025, and the quality assurance and improvement plan (QAIP) arising from the External Quality Assurance Review reported to the Audit & Governance Committee on the 16 June 2025, considered the statutory annual audit opinion within the Annual Internal Audit Report. It considered Internal Audit’s reports which set out executive summaries of findings, audit opinions, good practice and recommendations associated with each assurance review, as well as other work. It monitored the implementation of agreed actions through receipt of regular reports during the year from Internal Audit. The Audit Committee has reviewed the External Audit Strategy and Plan Overview for Midlothian Council, considered External Audit reports including the annual report to Members and the Controller of Audit on the annual audit of the Council, reviewed the main issues arising from the External Audit of the Council’s statutory accounts, and monitored the implementation of agreed actions arising. Page 47 of 128
Page 48
The Audit Committee received quarterly update reports from the Chief Officer Place during the year on strategic risks and mitigations. The Internal Audit Report on risk management concluded that level of assurance was substantial in relation to the Council’s Risk Management Policy and application of the policy at a strategic level. This review recommended some improvements to risk reporting to the Audit Committee to provide an update on the status of service risk registers in compliance with the Risk Management Policy which was due to be implemented in 2025. The Audit Committee considered the adequacy and effectiveness of the Council’s counter fraud arrangements by way of an annual report which set out the counter fraud activity and outcomes associated with the refreshed Counter Fraud Policy and Strategy approved by Council in August 2020. The Audit Committee is the governance body responsible for scrutiny of the treasury management strategy, mid-term and annual performance reports prior to their presentation to Council for approval, in accordance with the CIPFA Treasury Management Code of Practice. This scrutiny occurred during 2024/25 at Audit Committee meetings including the Annual Treasury Management Outturn Report 2023/24 and a 2024/25 in June 2024/June2025, the Treasury Management Mid-Year Review Report 2024/25 in November 2024, and the Treasury Management and Investment Strategy 2025/26 & Prudential Indicators in February 2025. The minutes of Audit Committee meetings were presented for approval by the Council, and any exceptional items or recommendations were referred to the Council in accordance with the remit. Membership The Membership of the Audit Committee reflects the Council’s approved Scheme of Administration i.e. there should be a one third equal split on all Committees reflecting the number of Councillors for each political party (May 2022), being five Members of the Council. A recruitment advert for an Independent Audit Committee Chair and Member was issued in May 2022, however no candidates applied for these positions, as a result agreement to rotate the Chair across the three political parties was agreed. The lack of independent members does not comply with the CIPFA Position Statement which recommends that each authority audit committee should include at least two co-opted independent members. However, this situation is similar to many Local Authority Audit Committees. Approval has now been given to recruit for up to 2 independent Audit Committee members during 2025. The Committee membership during the year included Councillors D Bowen, D McCall, W McEwan (Chair from September 2024), D Milligan (Chair until September 2024), and P Smaill. The attendance by each member at the Committee meetings throughout the year was as follows: Member 24 June 2024 30 September 2024 25 November 2024 24 February 2025 Cllr D Bowen √ √ √ √ Cllr D McCall √ √ √ √ Cllr W McEwan √ √ √ √ Cllr D Milligan √ √ X √ Cllr P Smaill √ √ X √ Every Audit Committee meeting in 2024/25 was quorate and only one meeting was not attended by all members. All other individuals who attended the meetings are recognised as being “In Attendance” only. The Chief Executive, Executive Directors, Chief Financial Officer(Section 95 Officer), External Audit (Audit Scotland), and Internal Audit attend all Audit Committee meetings, and other senior officers also routinely attend Audit Committee meetings. The Council has provided support and resources to the Audit Committee throughout the year including a Democratic Services Officer as the Minute secretary. Page 48 of 128
Page 49
Skills and Knowledge Given the wider corporate governance remit of Audit Committees within local government and the topics now covered by the external and internal audit functions, it is noteworthy that there is a range of skills, knowledge and experience that Audit Committee members bring to the committee, not limited to financial and business management. This enhances the quality of scrutiny and discussion of reports at the meetings. No one committee member would be expected to be expert in all areas. Self-Assessment of the Committee An annual self-assessment was carried out by members of the Audit Committee during August 2024 using the Good Practice Principles Checklist and Evaluation of Effectiveness Toolkit from the CIPFA Audit Committees Guidance. This was useful for Members to ensure the Committee can demonstrate its effectiveness as a scrutiny body as a foundation for sound corporate governance of the Council. The outcome of the self-assessments was a medium/high degree of compliance against the good practice principles and an improving and medium degree of effectiveness. Improvements were identified focussing on activity to improve its effectiveness in fulfilling its role. In summary these are: Schedule a recruitment, selection and appointment process for independent members of the Audit Committee within the next year. Provide members with a location on the Council shared drives for full versions of the Internal Audit Reports to be placed to ensure that the members always have full access to all Internal Audit reports. Consideration should always be given to making sure any national reports presented to committee are only put forward with a Midlothian specific covering paper providing appropriate information on the elements relevant to Midlothian Council. A private meeting between the Audit Committee members and External Audit should be arranged during 2025. These actions will all be taken forward during 2025/26. Assurance Statement to the Council The Audit Committee provides the following assurance to the Council: The Council has received the Minutes of the Audit Committee throughout the year. The Audit Committee has operated in accordance with its agreed terms of reference, covering the themes of Governance, Risk and Control, Internal Audit, External Audit, Financial Reporting, and Accountability Arrangements, and accordingly conforms to the Audit Committee principles within the CIPFA Position Statement for Audit Committees. It focused entirely on matters of risk management, internal control and governance, giving specialist advice to the Council on the value of the audit process, on the integrity of financial reporting and on governance arrangements, and acted as a bridge between the Council and other stakeholders. It did this through material it received from Internal Audit, External Audit, other Audit bodies, and assurances from Management relevant to Audit Cycle of reporting. The Audit Committee has reflected on its performance during the year, and has agreed areas of improvement to enable enhanced effectiveness to fulfil its scrutiny and challenge role. William McEwan Chair of Audit Committee 30 September 2025 Page 49 of 128
Page 50
Page 50 of 128
Page 51
CIPFA ‘audit committees’ Practical Guidance for Local Authorities and Police 2022 Edition Midlothian Council Audit Committee – self-assessment of Good Practice at 15 September 2025 Audit committee purpose and governance Yes/Partly /No Comments Does the authority have a dedicated audit committee? The Council’s Scheme of Administration approved in May 2022 lists the composition of the Council and its various Committees, including the Audit Committee. Does the audit committee report directly to full council? Has the committee maintained its advisory role by not taking on any decision-making powers? All Minutes of Audit Committee are circulated to full Council for noting and approval of any of their recommendations. An annual report is submitted by the Chair of the Audit Committee to full Council. Yes the Committee has no direct decision-making powers. Do the terms of reference clearly set out the purpose of the committee in accordance with CIPFA’s 2022 Position Statement? Terms of Reference of the Audit Committee are periodically reviewed against CIPFA’s best practice by the Chief Internal Auditor. Do all those charged with governance and in leadership roles have a good understanding of the role and purpose of the committee? The role and purpose of the Audit Committee is set out in the Council’s Scheme of Administration including what it can do, the arrangements for meetings, required quorums etc. References to the role of the Audit Committee are made and draft agendas and reports are presented to the Corporate Management Team by the Chief Internal Auditor in advance of each Audit Committee meeting. Does the audit committee escalate issues and concerns promptly to those in governance and leadership roles? The Audit Committee carries out the role set out in the Terms of Reference contributing to the Council’s governance framework which is set out in the Local Code of Corporate Governance approved by Council in March 2021. All Minutes of the Audit Committee are circulated to full Council for noting and approval of any recommendations. Does the governing body hold the audit committee to account for its performance at least annually? The Audit Committee annually reviews its terms of reference as part of it carrying out a self-assessment of performance using best practice checklists. An annual report is submitted by the Chair of the Audit Committee to full Council. It sets out the activities to enable stakeholders to understand how the Audit Committee has discharged its duties and identifies areas of improvement to fulfil its remit. MLC continues to adopt this best practice. Yes Yes Yes Yes Yes Yes Yes Page 51 of 128
Page 52
CIPFA ‘audit committees’ Practical Guidance for Local Authorities and Police 2022 Edition Midlothian Council Audit Committee – self-assessment of Good Practice at 15 September 2025 Functions of the committee Yes/Partly /No Comments Does the committee publish an annual report in accordance with the 2022 guidance, including: compliance with the CIPFA Position Statement 2022 results of the annual evaluation, development work undertaken and planned improvements how it has fulfilled its terms of reference and the key issues escalated in the year? Do the committee’s terms of reference explicitly address all the core areas identified in CIPFA’s Position Statement? See Appendix 1 evaluation against the statement does not have access to independent members despite recruitment campaign. See Appendix 1 evaluation of previous issues. Governance arrangements Functions in Terms of Reference Nos. 1, 3 & 4 Assurance framework Assurance Framework function in Terms of Reference No. 6 and explicit references to these service delivery models in Nos. 3, 6 & 7 within the revised Terms of Reference approved by Council in August 2019. Internal audit and Internal Control Arrangements including: o Financial management o Value for money o Ethics and standards o Counter fraud and corruption Functions in Terms of Reference Nos. 13-24 Function in Terms of Reference No. 12 Treasury Management and explicit references to ethics in Functions 3 & 19 within the revised Terms of Reference approved by Council in August 2019. External audit Functions in Terms of Reference Nos. 25-29 Functions of the committee (cont’d) Yes/Partly Comments Yes Yes Yes Yes Yes Yes Yes Page 52 of 128
Page 53
CIPFA ‘audit committees’ Practical Guidance for Local Authorities and Police 2022 Edition Midlothian Council Audit Committee – self-assessment of Good Practice at 15 September 2025 /No Risk management arrangements Functions in Terms of Reference Nos. 6-8 Annual Governance Statement Function in Terms of Reference No. 5 Assurance framework Functions in Terms of Reference Nos. 9-11 Over the last year, has adequate consideration been given to all core areas? Reports have been received that cover all core areas at meetings of the Committee. . Over the last year, has the committee only considered agenda items that align with its core functions or selected wider functions, as set out in the 2022 guidance? The Audit Committee has only considered items that align with its core functions. Has the committee met privately with the external auditors and head of internal audit in the last year? A private meeting has taken place with the Head of Internal Audit in 2025 a meeting will now be held with External Audit following conclusion of the 2025/26 work. Has the committee maintained its non-advisory role by not Has the Committee been established in accordance with the 2022 guidance as follows: Separation from the Executive A size that is not unwieldy and avoids the use of substitutes Inclusion of lay/co-opted independent members in accordance with legislation or CIPFA’s recommendation. Whilst during the year the committee membership included cabinet members this has been resolved with new memebership. Regular attendance by all members without substitutes evidences compliance. Despite a recruitment campaign lay members have not been successful in identifying and independent members for the Committee. A further campaign will occur in 2025. Yes Yes Yes Yes Yes Yes Partly Yes No Page 53 of 128
Page 54
CIPFA ‘audit committees’ Practical Guidance for Local Authorities and Police 2022 Edition Midlothian Council Audit Committee – self-assessment of Good Practice at 15 September 2025 Membership and support Yes/Partly /No Comments Have all committee members been appointed or selected to ensure a committee membership that is knowledgeable and skilled. Elected Members on the Audit Committee are selected in accordance with the arrangements set out in the Council’s Scheme of Administration. Committee members bring a wide variety of skills, experience and knowledge. Continued further training and development requirements will remain under review. . Has an evaluation of knowledge, skills and the training needs of the chair and committee members been carried out within the last two years? Following the May 2022 local government elections and appointment to the Audit Committee the elected members’ induction programme was completed, having assessed the needs of the Council members. Have regular training and support arrangements been put in place covering the areas set out in the 2022 guidance? Induction training has been provided for all member which covers key areas of the 2022 guidance further training is being provided by The Chief Internal Auditor. Across the committee membership, is there a satisfactory level of knowledge, as set out in the 2022 guidance? The Committee members have satisfactory level of knowledge and experience in all key areas. Does the committee have good working relations with key people and organisations, including external audit, internal audit and the chief financial officer? The independent Chair meets with Chief Internal Auditor (CIA) in advance of each Audit Committee meeting and has the option to meet with External Auditors, Audit Scotland, in private. The Chair has a pre-meeting with senior management prior to each Audit Committee meeting to enable wider context of Council business. Is adequate secretariat and administrative support to the committee provided? A Democratic Services Officer is assigned to the Audit Committee. Has the committee obtained positive feedback on its performance from those interacting with the committee or relying on its work? Are meetings well chaired, ensuring key agenda items are addressed with a focus on improvement? The Audit Committee will continue to obtain feedback on its performance from senior management and the external auditor. External review feedback of Internal Audit has been received by the Comittee As reflected in the Minutes of the Committee. Are meetings effective with a good level of discussion and engagement from all members? As reflected in the Minutes of the Committee. As reflected in the Minutes of the Committee. Yes Yes Yes Yes Yes Yes Yes Yes Yes YesPage 54 of 128
Page 55
CIPFA ‘audit committees’ Practical Guidance for Local Authorities and Police 2022 Edition Midlothian Council Audit Committee – self-assessment of Good Practice at 15 September 2025 Has the Committee maintained a non-political approach to discussions throughout? Effectivenss of the committee Yes/Partly /No Comments Does the committee engage with a wide range of leaders and managers, including discussion of audit findings, risks and action plans with the responsible officers? The Chief Executive, Directors, and Section 95 Officer attend all Audit Committee meetings and respond to members’ questions as appropriate for the business being considered by the Committee to ensure action findings and action plans are acted upon. The Chief Officer Place presents quarterly updates to the Committee setting out the corporate risks and mitigations. Does the committee make recommendations for the improvement of governance, risk and control arrangements? Recommendations are made by the Committee to Council in accordance with the business considered by the Committee. An Action Tracker for Audit Committee is in place to monitor completion of their recommended actions. Do audit committee recommendations havetraction with those in leadership roles? Has the committee evaluated whether and how it is adding value to the organisation? The Chief Executive, Directors, and Section 95 Officer attend all Audit Committee meetings and respond to members’ questions as appropriate for the business being considered by the Committee to ensure action findings and action plans are acted upon. The Audit Committee carries out an annual self assessment of performance against the CIPFA good practice checklist and the effectiveness toolkit from the CIPFA guidance 2022 ‘audit committees’, the latter enabling evaluation of how effectively it fulfils its Audit functions. Does the committee have an action plan to improve any areas of weakness? As part of its annual self-assessment 2024/25 the Committee has recognised where it could improve in respect of its scrutiny and challenge role to fulfil its remit and to further add value. Improvements are set out within the Audit Committee Annual/End of Term Report 2024/25. Has this assessment been undertaken collaboratively with the audit committee members? This Assessment was carried out in response to a request to complete assessment questionnaires sent to all Committee Members in July/August 2024.In addition a meeting was held with Audit Committee members in August 2025. Yes Yes Yes Yes Yes Yes Page 55 of 128
Page 56
Page 56 of 128
Page 57
CIPFA ‘audit committees’ Practical Guidance for Local Authorities and Police 2022 Edition Midlothian Council Audit Committee – self-assessment of Effectiveness 15 September 2025 Areas where the Audit Committee can add value by supporting improvement Examples of how the audit committee can add value and provide evidence of effectiveness Self-evaluation, examples, areas of strength and weakness Overall assessment 5-1 See key below 1. Promoting the principles of good governance and their application to decision making Supporting the development of a local code of governance. Providing robust review of the Annual Governance Statement (AGS) and the assurances underpinning it. Working with key members/governors to improve their understanding of the AGS and their contribution to it. Supporting reviews/audits of governance arrangements. Participating in self-assessments of governance arrangements. Working with partner audit committees to review governance arrangements in partnerships. Committee scrutinised Local Code of Corporate Governance, and recommended it for Council approval in March 2021, and scrutinised AGS within Annual Report and Accounts 2023/24 and 2024/25. Pre-Meet withthe Chair prior to each Committee meeting to provide wider context. Committee supports the role of audit in improving internal control and governance. Committee considers national reports and self- assessment toolkits. Reliance on previous years’ informal liaison with other Audit Committees e.g. MIJB. 5 (2023/24- 5) 2. Contributing to the development of an effective control environment. Actively monitoring the implementation of recommendations from auditors. Encouraging ownership of the internal control framework by appropriate managers. Raising significant concerns over controls with appropriate senior managers. Committee received periodic progress reports from Auditors e.g. follow-up activity. Directors attended Committee meetings to discuss progress with Audit actions. Action Log used to monitor completion of Committee recommendations. 5 (2023/24- 5) 3. Supporting the establishment of arrangements for the governance of risk and for effective arrangements to manage risks. Reviewing risk management arrangements and their effectiveness, e.g. risk management benchmarking. Monitoring improvements. Holding risk owners to account for major/strategic risks. A revised Risk Management Policy and Strategy was approved by Council in August 2022. The Committee continues to receive quarterly reports from Chief Officer Place on strategic risks and mitigations, with Directors in attendance. An Internal Audit review of risk management recommended improvements to reporting on Service Risk registers. 4 (2023/24-4) Page 57 of 128
Page 58
CIPFA ‘audit committees’ Practical Guidance for Local Authorities and Police 2022 Edition Midlothian Council Audit Committee – self-assessment of Effectiveness 15 September 2025 Areas where the Audit Committee can add value by supporting improvement Examples of how the audit committee can add value and provide evidence of effectiveness Self-evaluation, examples, areas of strength and weakness Overall assessment 5-1 See key below 4. Advising on the adequacy of the assurance framework and considering whether assurance is deployed efficiently and effectively. Reviewing the adequacy of the leadership team’s assurance framework. Specifying the committee’s assurance needs, identifying gaps or overlaps in assurance. Seeking to streamline assurance gathering and reporting. Reviewing the effectiveness of assurance providers, e.g. internal audit, risk management, external audit. Annual Strategies and Plans and periodic progress Reports received from Auditors which outline Governance and Assurance Framework, in alignment with Audit Cycle. Regular assurance reports provided on internal control, governance & risk management. 4 (2023/24 - 4) 5. Supporting effective external audit, with a focus on high quality and timely audit work. Reviewing and supporting external audit arrangements with focus on independence and quality. Providing good engagement on external audit plans and reports. Supporting the implementation of audit recommendations. External Audit Annual Plans and reports are submitted to the Committee and supported to conclusion of recommendations. 4 (2023/24–4) 6. Supporting the quality of the internal audit activity, particularly by underpinning its organisational independence. Reviewing the audit charter and functional reporting arrangements. Assessing the effectiveness of internal audit arrangements, providing constructive challenge and supporting improvements. Actively supporting the quality assurance and improvement programme (QAIP) of internal audit. Committee considered and approved the Internal Audit Charter. Committee considered and approved the Internal Audit Strategy and Plan, and regular Internal Audit reports with recommendations. Committee received Internal Audit QAIP and PSIAS conformance within mid-term performance and annual assurance reports. 5 (2023/24-5) 7. Aiding the achievement of the authority’s goals and objectives through helping to ensure appropriate governance, risk, control and assurance arrangements Reviewing how the governance arrangements support the achievement of sustainable outcomes. Reviewing major projects and programmes to ensure that governance and assurance arrangements are in place. Reviewing the effectiveness of performance management arrangements. Auditors provided audit review on governance arrangements and financial sustainability. Reliance on other Committees fulfilling their remits (Business Transformation Steering Group; Performance, Review and Scrutiny); knowledge from members appointed on those Committees used to evaluate their effectiveness. 4 (2032/24-4) Page 58 of 128
Page 59
CIPFA ‘audit committees’ Practical Guidance for Local Authorities and Police 2022 Edition Midlothian Council Audit Committee – self-assessment of Effectiveness 15 September 2025 Areas where the Audit Committee can add value by supporting improvement Examples of how the audit committee can add value and provide evidence of effectiveness Self-evaluation, examples, areas of strength and weakness Overall assessment 5-1 See key below 8. Supporting the development of robust arrangements for ensuring value for money. Ensuring that assurance on value for money arrangements is included in the assurances received by the audit committee. Considering how performance in value for money is evaluated in Annual Governance Statement (AGS). Following up issues raised by external audit in their value-for-money work. Auditors provided assurance on value for money arrangements e.g. sustainability, and performance management. AGS sets out the Governance Framework including arrangements for best value. 4 (2023/24-4) 9. Helping the authority to implement the values of good governance, including effective arrangements for countering fraud and corruption risks. Reviewing arrangements against the standards set out in the Code of Practice on Managing the Risk of Fraud and Corruption (CIPFA, 2014). Reviewing fraud risks and the effectiveness of the organisation’s strategy to address those risks. Assessing the effectiveness of ethical governance arrangements for both staff and governors. Committee received Counter Fraud Annual Report associated with refreshed Counter Fraud Policy and Strategy approved in 2020. Committee has requested self-assessment of fraud risks and counter fraud controls associated with national reports, and received assurance reports from Integrity Group. 5 (2023/24-5) 10. Promoting effective public reporting to the authority’s stakeholders and local community and measures to improve transparency and accountability. Working with key members to improve their understanding of the AGS and their contribution to it. Improving how the authority discharges its responsibilities for public reporting; for example, better targeting at the audience, plain English. Reviewing whether decision making through partnership organisations remains transparent and publicly accessible and encourages greater transparency. Publishing an annual report from the committee. Committee scrutinised Annual Report and Accounts 2023/24 including the enhanced Management Commentary for stakeholders. Reliance on health and social care governance arrangements (Integration Joint Board; IJB Audit and Risk Committee). Audit Committee Annual Report presented to Council in public. 4 (2023/24-4) Assessment key 5 Clear evidence is available from a number of sources that the committee is actively supporting improvements across all aspects of this area. The improvements made are clearly identifiable. Page 59 of 128
Page 60
CIPFA ‘audit committees’ Practical Guidance for Local Authorities and Police 2022 Edition Midlothian Council Audit Committee – self-assessment of Effectiveness 15 September 2025 Assessment key 4 Clear evidence from some sources that the committee is actively and effectively supporting improvement across some aspects of this area. 3 The committee has had mixed experience in supporting improvement in this area. There is some evidence that demonstrates their impact but there are also significant gaps. 2 There is some evidence that the committee has supported improvements, but the impact of this support is limited. 1 No evidence can be found that the audit committee has supported improvements in this area. Page 60 of 128
Page 61
Risk Management Policy and Strategy Derek Oliver, Chief Officer Place Report for Decision 1 Recommendations Audit Committee Tuesday 30 September 2025 Item No 5.6 Audit Committee is recommended to approve the revised Risk Management Policy and Strategy. 2 Purpose of Report/Executive Summary Audit Committee is presented with the revised Risk Management Policy and Strategy, which outlines the proposed approach to risk management and governance arrangements for risk monitoring and accountability. Date: 19 September 2025 Report Contact: Derek Oliver, Chief Officer Place, Derek.Oliver@midlothian.gov.uk Page 61 of 128
Page 62
3 Background/Main Body of Report 3.1 The Council has seen unprecedented change over the last five years, having successfully maintained critical services in response to a global pandemic and then undergone a transformational change in terms of workplace dynamics. It has demonstrated its competence to manage risk effectively during this time and continued to operate within increasing financial constraints. 3.2 Whilst the Council’s response has shown that risk has been managed appropriately and proportionate mitigations have been applied, the events of the last five years should be reflected in the Council’s risk management approach going forward. 3.3 The Risk Management Policy and Strategy was last presented in August 2022 and is due review. In addition, in February 2024, an Internal Audit report identified additional recommendations to enhance the effectiveness of the Council’s risk management approach. These have been incorporated into the revised Risk Management Policy and Strategy. Risk Management Policy and Strategy - summary 3.4 Midlothian Council acknowledges that risk can never be eliminated in its entirety. The Council also recognises that managing risk can also identify positive opportunities which, with the appropriate level of control, may lead to service improvements. Therefore, the measures which the Council adopts are principles of good management practice which seek to control and balance risk and opportunity. Specifically, in the area of risk management, the Council seeks to: Always meet its statutory obligations, and act within the law. Safeguard the public at large, the Council's members, employees, pupils, tenants and all people to whom the Council has a duty of care. Protect its property, including buildings, equipment, vehicles or any other assets and resources. Preserve and enhance service delivery. Maintain effective control of public funds. Maintain and enhance the Council's reputation. Safeguard and enhance the quality of Midlothian’s environment. 3.5 The main objective of the revised Policy and Strategy is to ensure that risk management is an integral part of the Council's corporate and service management, forms part of the Council's governance, planning and service delivery operations and allows for monitoring and reporting on the effectiveness of that strategy. Page 62 of 128
Page 63
3.6 The Policy and Strategy applies to all of Midlothian Council’s core functions. Where Midlothian Council enters into partnerships, contracts and agreements the same principles of risk management established by this policy and strategy and supporting guidance, should be considered as best practice and applied where possible. It is also expected that our significant contractors have risk management arrangements at a comparable level, which should/must be established and monitored through commissioning processes and contract management arrangements. 3.7 It is essential that a single risk management approach be utilised at all levels throughout the Council. By demonstrating good governance through effective management of risks and opportunities, the Council will be in a stronger position to deliver its objectives, provide improved services to the public, work better as a partner with other organisations and achieve value for money. 3.8 Risk management is a part of service and corporate/strategic management and accordingly is integrated within normal management processes. The Chief Executive has overall responsibility for the management of risk within Midlothian Council. The Chief Officer Place has responsibility for ensuring that the Council’s Risk Management Strategy, Policy and Strategic Risk Register are maintained and regularly reviewed. 3.9 The Chief Officer Place, who Chairs the Strategic Risk & Resilience Group, reports on updates to the Strategic Risk Register every quarter to Council Management Team and the Audit Committee, or when a new significant risk is identified. 3.10 The Strategic Risk & Resilience Group membership is drawn from Chief Officers and Senior Managers across the Council and provides recommendations to the Council Management Team on the escalation, de- escalation and closure of strategic level risks. 3.11 Similarly, Directorates and Services are required to undertake quarterly review, monitoring and reporting on their service risk registers (supported by the risk management function) to ensure that risks are identified and escalated to the appropriate level at an early stage where that is appropriate. All risk registers are recorded and maintained on the Pentana Risk Management system. 3.12 The internal audit report of February 2024 expressed some weaknesses in these processes and detailed a number of recommendations as to how the Council’s risk management could be improved, namely: The creation of terms of reference for the Strategic Risk and Resilience Group (see Section 6.9 of revised risk Management Policy & Strategy report – Appendix B). The reinstatement of the officer level Risk & Resilience Group which ceased to meet in 2021. Terms of reference for this group are also detailed in the revised Risk Management Policy (Section 6.10). The main function of this group will be to consider risks at service level rather than strategic level and to provide support and guidance to service managers. The need to draw up independent action plans for each Critical Risk to ensure they remain critical for no longer than absolutely necessary (Section 6.9 & 10.20). Page 63 of 128
Page 64
The introduction of reporting mechanisms so that regular formal updates can be presented to the Audit Committee on compliance with the Risk Management Policy and the status of service risk registers in general (Section 6.6 and 9.2). To ensure that the Council’s Strategic Risk Register links to organisational objectives (section 6.9). To ensure significant project risks are identified and included as part of the Council’s performance reporting arrangements and risk management framework (Section 6.9). Appropriate risk management procedures, guidance, training, and support be provided to management including the creation of an e- learning module, mandatory for relevant managers (Section 3.3 & 6.10). 3.13 All these recommendations, together with the additional of updated technical guidance, have been incorporated into the revised Risk Management Policy and Strategy which is contained in Appendix B. Council is asked to consider and approve the contents within. 4 Report Implications (Resource, Digital and Risk) 4.1 Resource Recommendation 5.3 within Internal Audit’s report on Risk Management, February 2024, identifies that the level of risk management resource required to support the Council should be considered as part of the review of Health, Safety, Risk and Resilience. The arrangements required in re-establishing and maintaining the Risk & Resilience Group will require staff time and commitment. There will also be individual impacts on service risk managers when carrying out risk assessments and related mitigation actions. These will have to be managed by the respective service. 4.2 Digital The Risk Management Policy and Strategy is a document held within Sharepoint and available on the Intranet. Risk registers/profiles are stored within Pentana which is an existing Council system. There are no additional requests relating to Digital, therefore no impact. 4.3 Risk The risk of not having a robust Risk Management Policy and Strategy is that the Council does not fulfil its statutory duty. Good governance leads to good management, good performance, good stewardship of public money, good public engagement and, ultimately, good outcomes for citizens and service users. 4.4 Ensuring Equalities (if required a separate IIA must be completed) The Risk Management Policy and Strategy will ensure that that Council meets its statutory requirements including those under the Equalities Act 2010. The Risk Management Policy and Strategy will help the Council to safeguard the public at large, the Council's members, employees, pupils, tenants and all people to whom the Council has a duty of care.Page 64 of 128
Page 65
4.4 Additional Report Implications (See Appendix A) See Appendix A Appendices Appendix A – Additional Report Implications Appendix B – Risk Management Policy and Strategy Page 65 of 128
Page 66
APPENDIX A – Report Implications A.1 Key Priorities within the Single Midlothian Plan Risk management is an integral part of the Council's corporate and service management, forms part of the Council's governance, planning and service delivery operations and allows for monitoring and reporting on the effectiveness of that strategy. The Risk Management Policy and Strategy should underpin all the priorities within the Single Midlothian Plan. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious None of the above A.4 Delivering Best Value The Council’s commitment to best value and securing continuous improvement can best be delivered when decisions are made against a backdrop of understanding the risks and opportunities before an organisation. The Risk Management Policy and Strategy seeks to provide the framework in which the current risk environment is understood and demonstrate that Midlothian Council is taking appropriate action in response to those identified risks. A.5 Involving Communities and Other Stakeholders The Risk Management Policy and Strategy was informed by the Risk and Resilience Group, Corporate Management Team and Audit Committee. Page 66 of 128
Page 67
A.6 Impact on Performance and Outcomes Formal monitoring and accountability procedures form an integral part of the risk management process, covering the following three main issues: Delivering the risk management strategy. Implementing risk management action plans, both corporate/strategic and service. Determining whether the related actions are making a difference to the risk, as appropriate. A.7 Adopting a Preventative Approach The Risk Management approach being taken by the Council is founded on a preventative approach to managing risks, where appropriate and more generally to decision making with far greater risk awareness. A.8 Supporting Sustainable Development Senior Managers must ensure the sustainability of the Council, which entails identifying, understanding and managing Strategic and Service level Risks and Opportunities. Page 67 of 128
Page 68
Page 68 of 128
Page 69
Midlothian Council Risk Management Policy & Strategy 2025 MIDLOTHIAN COUNCIL RISK MANAGEMENT POLICY & STRATEGY Page 69 of 128
Page 70
Midlothian Council Risk Management Policy & Strategy 2025 CONTENTS Section TOPIC Page No. 1.0 Policy Statement 3 2.0 Terminology 4 Governance 4 Risk 4 Risk Management 4 Effective Risk Management 4 3.0 Objectives 5 4.0 Approach 5 5.0 Status of Risk Management 6 6.0 Management Arrangements & Responsibilities 6 Chief Executive 7 Chief Officer – Place 7 Executive Directors 7 Chief Officers 7 Senior Managers 7 Council Management Team 7 Strategic Risk & Resilience Group 8 Risk & Resilience Group 8 Audit Committee 9 7.0 Health & Safety 9 8.0 Business Continuity 9 9.0 Monitoring and Accountability 9 10.0 Approach to Risk Management 10 Risk Management Process 10 Risk Identification 10 Risk Elements 11 Risk Types 11 Risk Analysis & Assessment 13 Risk Matrix 14 Risk Evaluation 14 Risk Controls & Actions 14 Risk Appetite, Tolerance and Escalation 15 Risk Review 15 Risk Reporting 15 11.0 Review 15 Appendix A – Risk Matrix Page 70 of 128
Page 71
Midlothian Council Risk Management Policy & Strategy 2025 1. Policy Statement 1.1 Risk is present in everything we do. The Council understands the importance of recognising and managing the many risks which are inherent in its activities, and in the services which it provides for the benefit of the community. To do this properly it is important to have a competent and healthy risk management culture across the Authority, throughout our activities, partnerships, and projects, with judgement based on an understanding of the risk and the level of exposure that is acceptable. The Council has therefore adopted this risk management policy and strategy and has implemented procedures to support its delivery. 1.2 The main objective of this policy is to ensure that risk management is made integral part of the Council's corporate and service management, forms part of the Council's governance, planning and service delivery operations and allows for monitoring and reporting on the effectiveness of the strategy. 1.3 The Local Authority and our partners will over time experience a wide range of significant risks. The different types of risks are detailed further in this policy document. However, Midlothian Council acknowledges that risks occur at all levels of the Council's functions and activities and can never be eliminated in their entirety. The Council also recognises that managing risk can identify positive opportunities which, with the appropriate level of control, may lead to service improvements. Therefore, the measures which the Council adopts are principles of good management practice which seek to control and balance risk and opportunity. 1.4 Specifically, in the area of risk management, the Council seeks to: Always meet its statutory obligations, and to act within the law. Safeguard the public at large, the Council's members, employees, pupils, tenants and all people to whom the Council has a duty of care. Protect its property, including buildings, equipment, vehicles or any other assets and resources. Preserve and enhance service delivery. Maintain effective control of public funds. Maintain and enhance the Council's reputation. Safeguard and enhance the quality of Midlothian’s environment. 1.5 The Council will promote these objectives by systematically identifying, evaluating, and thereafter seeking to control and monitor all foreseeable risks which would potentially endanger, or which could have a detrimental effect upon the aims and objectives stated above. 1.6 The Council will support its members and officials in developing the necessary skills and competencies to enable the provision of good quality risk management within the Council. 1.7 Managing risk is the responsibility of everyone and needs to be reflected in the actions of all (staff and elected members). There is a commitment to embed risk management throughout Midlothian Council, promote a positive risk culture and make it a part of everyday service delivery and decision-making, while ensuring that sufficient resources are also allocated to this. This includes fostering an environment that embraces openness, supports integrity, objectivity, accountability and transparency in the identification, assessment and management of risks, welcoming constructive challenge and promoting collaboration, consultation and cooperation. 1.8 This policy and strategy applies to all of Midlothian Council’s core functions. Where Midlothian Council enters into partnerships, contracts and agreements, the same principles of risk management established by this policy and strategy and supporting guidance, should be considered as best practice and applied wherever possible. It is also expected that our Page 71 of 128
Page 72
Midlothian Council Risk Management Policy & Strategy 2025 significant contractors have risk management arrangements at a comparable level, which should / must be established and monitored through commissioning processes and contract management arrangements. 1.9 Risk Management enhances strategic planning and prioritisation, assists in achieving objectives and strengthens organisational agility to respond to challenges. To meet our organizational objectives, improve service delivery and achieve value for money for the residents of Midlothian, risk management will be an essential and integral part of planning and decision-making. 1.10 Midlothian is the fastest growing local authority area in Scotland. Within the Council’s Transformation Blueprint is a commitment to reducing inequalities in health outcomes, learning outcomes and economic circumstances while addressing the health of the planet. Its strategic goal is to create a wellbeing economy where the people and the environment of Midlothian flourish and are put first. 1.11 All of these strategic and corporate aspirations require careful planning, competent staff, resources, plant, and materials to come to fruition and inevitably this comes with both risks and opportunities. The risk culture must therefore be an active and healthy one with a drive and motivation to place risk at the top of the agenda. 1.12 This risk management and policy strategy will provide a proactive and systematic approach to support the management of risk and will inform decisions including resource allocation to ensure continuity of essential Council services. 2. Terminology 2.1 Governance The system by which local authorities fulfil their purpose and achieve their intended outcomes for citizens and service users and operate in an effective, efficient, economic and ethical manner. Good governance leads to good management, good performance, good stewardship of public money, good public engagement and, ultimately, good outcomes for citizens and service users. 2.2 Risk Simply put, risk is the effect of uncertainty on objectives. This can be further defined as “the combination of the likelihood of an event occurring (or not occurring, as the case may be) and its impact on the organisation”. This can be both positive or negative. However, the main priority of Midlothian Council, being a public sector organisation, is to protect itself against negative risk, the chance or possibility of loss, damage, injury or failure to achieve objectives caused by an unwanted or uncertain action or event. 2.3 Risk Management The planned and systematic approach to the identification, evaluation and control of risk. The objective of risk management is to secure the assets and reputation of the organisation and to ensure the continued financial and organisational well-being of the Council. All organisations exist to achieve their objectives. The purpose of risk management is to manage the barriers in achieving these objectives. 2.4 Effective Risk Management Having a process in place that can identify what might go wrong, what the consequences of that might be and deciding what can be done to reduce or eliminate the likelihood of it occurring. In the event that something does go wrong, effective risk management is also about taking steps to ensure that the impacts are kept to a minimum whilst still achieving organisational objectives. Page 72 of 128
Page 73
Midlothian Council Risk Management Policy & Strategy 2025 3. Objectives 3.1 Midlothian Council is committed to establishing and maintaining a systematic approach to the identification and management of risk. 3.2 The Council’s risk management objectives are to: Ensure that risk management is clearly and consistently integrated and evidenced in the culture of the Council. Actively manage and reduce risk in accordance with best practice. Anticipate and respond to changing political, economic, social, technological, legal and environmental factors and influences. Ensure compliance with health and safety, insurance and legal requirements as a minimum standard. Prevent death, injury, damage and losses, and reduce the cost of incidents and accidents. Inform policy and operational decisions by identifying risks and their likely impact. Raise awareness of the need of risk management by all those connected with the Council's delivery of service. Encourage positive risk taking and the identification of opportunities. 3.3 These objectives will be achieved by: Clearly defining the roles, responsibilities and reporting lines within the Council for risk management. Setting out clear risk management processes. Continuing to demonstrate the application of risk management principles in the activities of the Council, its employees and members. Reinforcing the importance of effective risk management as part of the everyday work of employees and members. Maintaining a register of strategic risks and opportunities relevant to the Council's business and strategic objectives, including those linked to working in partnerships. Maintaining registers of risks relevant to every Council service. Maintaining documented procedures for the control of risk and provision of suitable information, training and supervision. Maintaining an appropriate system for recording health and safety incidents, responses and identifying preventative measures against recurrence. Preparing contingency plans to secure business continuity where there is a potential for an event to have a major impact upon the Council's ability to function or the delivery of its critical services. Monitoring arrangements continually and seeking continuous improvement. 4. Approach 4.1 It is essential that a single risk management approach be utilised at all levels throughout the Council. By demonstrating good governance through effective management of risks and opportunities, the Council will be in a stronger position to deliver its objectives, provide improved services to the public, work better as a partner with other organisations and achieve better value for money. 4.2 This approach to risk management will inform the Council's business processes, including: Strategic planning. Financial planning. Service planning. Policy making and review. Performance management. Project management. Partnership working. Page 73 of 128
Page 74
Midlothian Council Risk Management Policy & Strategy 2025 4.3 It is essential in order to achieve the objectives referred to in section 3 that processes are in place to identify and assess risks and opportunities, develop and implement controls and warning mechanisms, and to review and report on progress. 4.4 The identified risks and relevant control measures will be managed through the Council's Strategic Risk Register. 4.5 There are five key principles of risk management that provide the basis on which Midlothian Council will manage risk: A. Governance and Leadership – risk management shall be an essential part of governance and leadership, and fundamental to how the organisation is directed, managed and controlled at all levels. B. Integration – risk management shall be an integral part of all organisational activities to support decision-making in achieving objectives. C. Collaboration and Best Information – risk management shall be collaborative and informed by the best available information. D. Structured Processes – risk management processes are recognised as iterative in practice, rather than sequential, and shall be structured to include: Risk Identification and Assessment – to determine and prioritise how the risks should be managed. Risk Treatment – the selection, design and implementation of risk treatment options that support achievement of intended outcomes and manage risks to an acceptable level. Risk Monitoring – the design and operation of integrated, insightful and informative risk monitoring. Risk Reporting – timely, accurate and useful risk reporting to enhance the quality of decision-making and to support management and oversight bodies in meeting their responsibilities. E. Continual Improvement – risk management shall be continually improved through learning and experience. 5. Status of Risk Management 5.1 Risk management is as much a part of the duties of Council officials as, for example, the control of budgets or the deployment of staff and assets. It is one of many substantive issues to be considered by elected members when making decisions. If the Council is to have reasonable assurance that risk management is effective, and is effectively part of the Council's operations, it must be carried out in a systematic and structured manner and be subject to monitoring and reporting on its effectiveness. 6. Management Arrangements & Responsibilities 6.1 Risk management is an essential part of service and corporate / strategic management and accordingly, is integrated within normal management processes. The Risk Management Reporting Framework below illustrates the Council’s risk management structure: Page 74 of 128
Page 75
Midlothian Council Risk Management Policy & Strategy 2025 6.2 The Chief Executive has overall responsibility for the management of risk within Midlothian Council. 6.3 Chief Officer – Place has responsibility for ensuring that the Council’s Risk Management Strategy, Policy and Strategic Risk Register are maintained and regularly reviewed. Risk owners will be clearly identified within the Strategic Risk Register. The register will be reviewed quarterly, or where a new significant risk is identified. This will then be presented to the Council Management Team for approval and thereafter to the Audit Committee. 6.4 Executive Directors are responsible for ensuring the Strategic Risk Register is compiled and maintained in respect of their Service. 6.5 Chief Officers are responsible for ensuring all known risks falling within their service portfolio are reviewed quarterly. They must also ensure that any new or emerging risks are immediately assessed and evaluated. 6.6 Senior Managers will ensure that Service Risk Registers are reviewed quarterly, or where a new risk is identified. Any identified risk which has a wider corporate impact will be escalated to the Strategic Risk Register. 6.7 The Corporate Management Team (CMT) shall: Determine the levels of risk and outcomes that are tolerable and acceptable to achieve the Council's objectives. Provide advice to elected members on the type and amount of risk to accept when making policy decisions. Assume ownership of the strategic risks recorded in the Strategic Risk Register. Carry out a strategic overview of the Strategic Risk Register quarterly. Promote and support the implementation of the risk management policy and strategy throughout the Council. Page 75 of 128
Page 76
Midlothian Council Risk Management Policy & Strategy 2025 6.8 Identified risks will be allocated to an officer of the CMT and each risk will be accompanied by an assessment of likelihood and impact. Registers will be accompanied by related actions, highlighting the means by which the risk will be controlled. 6.9 The Strategic Risk & Resilience Group sits at a strategic level and so has membership drawn from Chief Officers and Senior Managers across the Council. The group, chaired by the Chief Officer-Place, meets quarterly (minuted) and its purpose is to: review and update the Council’s Strategic Risk Register. provide a quarterly report to CMT and the Audit Committee ensure that the Council’s Strategic Risk Register links to organisational objectives. ensure significant project risks are identified and included as part of the Council’s performance reporting arrangements and risk management framework identify strategic issues, risks and opportunities to be included in the strategic risk register. define strategic issues and risks and identify control measures to reduce or eliminate any adverse impacts on the Council. define strategic opportunities and identify appropriate control measures to ensure these are fully utilised. identify ownership of strategic risks and opportunities recorded in the Strategic Risk Register. assess and evaluate the levels of risk (likelihood and impact) and decide whether these are tolerable and acceptable to achieve Council objectives. identify necessary actions and timescales and to draw up independent action plans for each “Critical” risk to ensure they remain critical for no longer than absolutely necessary. consider strategic issues, risks and opportunities brought to its attention by the Risk & Resilience Group or other Council forums. promote and support the implementation of the risk management policy throughout the Council and to ensure that adequate resources are provided to enable its full implementation. 6.10 The Risk & Resilience Group (RRG) membership consists of a representative from each Senior Management level service area of the Council. This is not a decision-making body, as recommendations that have a strategic or corporate impact are referred to the Strategic Risk & Resilience Group and Council Management Team. The group will sit at a tactical/operational level and will: promote a culture of risk awareness and resilience throughout the Authority receive and consider risk management updates from each service as a standing agenda item at each quarterly meeting of the group (minuted). assist with the development, review (2 yearly), and application of the Risk Management Policy. provide a platform to identify any issues which may affect compliance with the Risk Management Policy. provide advice, suggestions or comment on the content of the strategic risk register to the Strategic Risk & Resilience Group. provide a forum for peer support and motivation. facilitate the provision of risk management advice and training to nominated risk management leads. share examples of risk management best practice with risk officer leads. report and escalate concerns to relevant Service Teams and the Strategic Risk & Resilience Group, as appropriate. promote the development of resilience strategies to ensure business continuity and the ability to respond effectively to disruption. have wider responsibilities in relation to Business Continuity as outlined in the Council’s Business Continuity Plan, namely: o including business continuity updates as a standing agenda item at each meeting of the group. Page 76 of 128
Page 77
Midlothian Council Risk Management Policy & Strategy 2025 o providing a platform to identify any issues which may affect compliance with the requirements outlined in the Corporate Business Continuity Plan. o escalating any concerns to Divisional Management Teams and Corporate Management Team as appropriate. 6.11 The Audit Committee evaluates and recommends approval of the strategies and frameworks in respect of risk management. The Committee approves updates and provides direction in respect of risks held within the strategic risk register. 7. Health & Safety 7.1 The Council has responsibilities under health and safety legislation to ensure the health, safety and welfare at work of employees and other people affected by the Council's business. Managing health and safety risks is an integral part of business risk management and the management of such risks should not be taken in isolation. Poor health and safety management can have a negative impact on other business risks such as reputation, insurance, business continuity and financial resources. 7.2 The effective management of health and safety risks, as with all significant corporate risks, is an essential part of the role of managers. The organisation and arrangements for managing health and safety within the Council are detailed in the Council’s Health and Safety Policy and associated management arrangement documents. 8. Business Continuity 8.1 The business continuity process is essentially risk management applied to the whole organisation and its ability to continue with its service provision in the event of a catastrophic or a localised operational impact event. The Council ensures risk management processes are applied throughout the business continuity lifecycle. 9. Monitoring and Accountability 9.1 Formal monitoring and accountability procedures form an integral part of the risk management process, covering the following three main issues: Delivering the risk management policy. Implementing risk management action plans, both corporate/strategic and at service level. Determining whether the related actions are making a difference to the risk evaluation, as appropriate. 9.2 The following monitoring arrangements are in place: The Strategic Risk Register is presented to the Audit Committee quarterly to advise members of the risks and opportunities which may affect the achievement of the Council’s strategic objectives. Service risks and the status of service risk registers are monitored through quarterly performance reports so that any performance risks are highlighted to the Council Management Team through exception reporting. Annual reporting on compliance with the Risk Management Policy and the status of service risk registers Council wide. Ensuring that the Strategic Risk & Resilience Group and Risk & Resilience Group continue to be an effective and streamlined means of maintaining an overview of risk management and supporting corporate and strategic consistency in the implementation of the risk management policy. Internal audit of risk management processes across the Council and the reporting on the efficiency and effectiveness of internal controls. Page 77 of 128
Page 78
Midlothian Council Risk Management Policy & Strategy 2025 10. Approach to Risk Management Risk Management Process 10.1 The diagram below, illustrates the process and cycle of risk management. This is taken from the international standard ISO 31000 which provides principles and guidelines for risk management. 10.2 This demonstrates that risk management is a dynamic process, requiring frequent review of existing risks and monitoring of the environment to ensure that the risks captured represent the current profile of the organisation. 10.3 Continual communication of risks within the organisation is essential to allow for informed decision-making. Communication to the Audit Committee and other stakeholders is imperative to allow effective scrutiny and provide assurance that all risks are being effectively managed. 10.4 Risk Identification The aim of risk identification is to recognise and articulate the risks that may help or prevent Midlothian Council achieving its objectives. It is particularly relevant to consider new or emerging risks alongside business planning and strategy formulation processes. There are several risk categories: Corporate - would have a major impact on the organisation or delivery of its priorities. Corporate risks also include cross-cutting risks that impact across directorates. Change related (Programme / Project) – where we are exposed to risks that could affect our ability to successfully complete the desired transformational outcomes or deliver predefined outputs that enable us to deliver outcomes and realise benefits. Operational / Service / Contract – where we are exposed to risks that could affect Page 78 of 128
Page 79
Midlothian Council Risk Management Policy & Strategy 2025 our control and ability to successfully and continually deliver or commission services to our service users / residents. 10.5 The Risk Elements are normally expressed in terms of causes, events and consequences (see diagram below). A Cause is an element which alone or in combination has the potential to give rise to risk. An Event is an occurrence or change of a set of circumstances and can be something that is expected which does not happen or something that is not expected which does happen. Events can have multiple causes and consequences and can affect multiple objectives. The Consequences, should the event happen, are the outcome of an event affecting objectives, which can be certain or uncertain, can have positive or negative direct or indirect effects on objectives, can be expressed qualitatively or quantitively, and can escalate through cascading and cumulative effects. A practical use of this model could be illustrated as follows: 10.6 Risk Types: (Taken from HM Govt The Orange Book 2023) Page 79 of 128
Page 80
Midlothian Council Risk Management Policy & Strategy 2025 Strategy risks – Risks arising from identifying and pursuing a strategy, which is poorly defined, is based on flawed or inaccurate data or fails to support the delivery of commitments, plans or objectives due to a changing macro-environment (for example, political, economic, social, technological, environment and legislative change). Governance risks – Risks arising from unclear plans, priorities, authorities and accountabilities, and/or ineffective or disproportionate oversight of decision-making and/or performance. Operations & Continuity Risks – Risks arising from inadequate, poorly designed or ineffective/inefficient services/processes resulting in impaired customer service (quality and/or quantity of service), fraud, error, non-compliance and/or poor value for money. Legal risks – Risks arising from a defective transaction, a claim being made (including a defence to a claim or a counterclaim) or some other legal event occurring that results in a liability or other loss, or a failure to take appropriate measures to meet legal or regulatory requirements or to protect assets (for example, intellectual property.) Safety risks – Risks arising from safety deficiencies or poorly designed or ineffective/inefficient hazard management resulting in non-compliance and/or harm and suffering to employees, contractors, service users or the public. Financial risks – Risks arising from not managing finances in accordance with requirements and financial constraints resulting in poor returns from investments, failure to manage assets/liabilities or to obtain value for money from the resources deployed, and/or non-compliant financial reporting. Commercial risks – Risks arising from weaknesses in the management of commercial partnerships, supply chains and contractual requirements, resulting in poor performance, inefficiency, poor value for money, fraud, and/or failure to meet business requirements/objectives. People risks – Risks arising from ineffective leadership and engagement, suboptimal culture, inappropriate behaviours, the unavailability of sufficient capacity and capability, industrial action and/or non-compliance with relevant employment legislation/HR policies resulting in negative impact on performance. Technology risks – Risks arising from technology not delivering the expected services due to inadequate or deficient system/process development and performance or inadequate resilience. Information risks – Risks arising from a failure to produce robust, suitable and appropriate data/information and to exploit data/information to its full potential. Security risks – Risks arising from a failure to prevent unauthorised and/or inappropriate access to the estate and information, including cyber security and non-compliance with General Data Protection Regulation requirements. Project/programme risks – Risks that change projects and programmes are not aligned with strategic priorities and do not successfully and safely deliver requirements and intended benefits to time, cost and quality. Reputational risks – Risks arising from adverse events, including ethical violations, a lack of sustainability, systemic or repeated failures or poor quality or a lack of innovation, leading to damages to reputation and/or destruction of trust and relations. 10.7 Failure to manage risks in any of these categories may lead to financial, reputational, Page 80 of 128
Page 81
Midlothian Council Risk Management Policy & Strategy 2025 legal, regulatory, safety, security, environmental, employee, customer and operational consequences. 10.8 The following factors, and the relationship between these factors, should be considered when identifying risks: Changes in the external and internal context Causes and events Consequences and their impact on objectives Threats and opportunities Vulnerabilities and capabilities Uncertainties and assumptions within options, strategies, plans or initiatives Indicators or emerging risks Limitations of knowledge and reliability of information Time-related factors Any potential biases and beliefs of those involved. 10.9 Risks will be identified whether or not their sources are under the Council’s direct control, as they have the potential to impact on achievement of objectives, causing great damage or creating significant opportunity. 10.10 Risk Analysis and Assessment The aim of risk analysis is to build understanding of the nature of risk and its characteristics including, wherever possible, the level of risk. It involves consideration of uncertainties, risk sources, consequences, likelihood, events, scenarios, controls and their effectiveness. Analysis techniques can be qualitative, quantitative or a combination of these, depending on the circumstances and intended use. 10.11 The assessment, or scoring, of risk allows for prioritisation by evaluation. Determining the likelihood and impact of a risk and utilising a standardised assessment criteria to assign a score based on these factors allows the Council to understand and prioritise which risks to mitigate first. 10.12 The descriptives in the table below are taken from the Council’s Risk Matrix and illustrates the scoring system used to attribute scoring to degrees of Likelihood and Impact. The more likely that a risk will be realised, or the greater the impact it will potentially have on the organisation, the higher the score. 10.13 The Council’s Risk Matrix as illustrated in Appendix A, includes guidance for each level and type of Impact, e.g. financial, time, reputation, legal etc. The overall impact descriptive/score to be used in the risk assessment is the one that corresponds to the type of impact with the greatest negative effect 10.14 When both the likelihood and impact scores are applied to the risk matrix (see below), the risk is then given an overall rating as either, Very Low, Low, Medium, High or Critical. SCORE LIKELIHOOD IMPACT 5 Certain Critical 4 Likely Major 3 Possible Moderate 2 Unlikely Minor 1 Remote Minimal Page 81 of 128
Page 82
Midlothian Council Risk Management Policy & Strategy 2025 RISK MATRIX IMPACT 1 Minimal 2 Minor 3 Moderate 4 Major 5 Critical 5 Certain 5 LOW 10 MEDIUM 15 MEDIUM 20 HIGH 25 CRITICAL 4 Likely 4 LOW 8 LOW 12 MEDIUM 16 HIGH 20 HIGH 3 Possible 3 VERY LOW 6 LOW 9 MEDIUM 12 MEDIUM 15 MEDIUM 2 Unlikely 2 VERY LOW 4 LOW 6 LOW 8 LOW 10 MEDIUM LIKELIHOOD 1 Remote 1 VERY LOW 2 VERY LOW 3 VERY LOW 4 LOW 5 LOW As indicated by the downward diagonal arrow, the direction of travel is always to actively reduce risk. 10.15 Risk Evaluation Once analysed, risks will be evaluated to compare the results against the nature and extent of risks that the organisation is willing to take or accept to determine where and what additional action is required. 10.16 Risk Controls & Actions Risk controls are management measures put in place to effectively manage a risk to within acceptable levels (i.e. within target score). It is essential that the controls put in place to manage a risk are effective. The identification of effective controls is the most important part of the whole risk management process as without this element the Council would simply be identifying risks and doing nothing to manage them. There are two main types of control measure that can be put in place to manage a risk: Preventative Controls: These are mitigating actions which will work to control the cause of the risk and prevent it happening in the first place. Contingency Controls or Mitigating Actions: These are actions that can be put in place to reduce the impact of the risk when it does materialise. Page 82 of 128
Page 83
Midlothian Council Risk Management Policy & Strategy 2025 10.17 Risk Appetite, Tolerance and Escalation Midlothian Council recognises that risk is inherent in delivering and commissioning services and does not seek to avoid all risk, but instead aims to have an ‘open’ approach to risk, appropriately balancing risk against reward, with risks managed in a proportionate manner. 10.18 This will require an approach that allows flexibility and support for well-informed and considered risk taking, promoting transparency and effective risk management, while maintaining accountability. While risks defined as “critical” or ‘high’ are to be actively managed down to a tolerable level wherever possible, it is important that risks across the Authority are not over-controlled. 10.19 It is not realistic for the Council, with its diverse range of services and duties, to have just one definitive application of risk appetite across the entire organisation. Instead, risk appetite should be set with reference to the strategy for service delivery in each particular area. However, examples of risks viewed as intolerable are those that are likely to: Negatively affect the safety of our service users, residents or employees. Severely damage the Authority’s reputation. Lead to breaches of laws and regulations. Endanger the future operations of the Local Authority (i.e. by exceeding the risk capacity of the organisation – the amount of risk that the Authority can bear). Adversely impact the financial security or resilience of the Council. 10.20 In addition, to aid managers in understanding what risks are acceptable, our appetite for risk is implicitly defined within our standard for determining risk levels. Risks rated as “Critical” will be deemed to have exceeded tolerance levels and will be subject to escalation to the Strategic Risk & Resilience Group for review and action. The target rating for a risk is expected to be ‘medium’ or lower. In the event that this is not deemed realistic in the short to medium term, this shall be discussed as part of the escalation process, and this position regularly reviewed with the ultimate aim of bringing the level of risk to a tolerable level. Independent action plans will be drawn up for each “Critical” risk to ensure they remain critical for no longer than absolutely necessary. 10.21 Risk Review Once the process of identifying, analysing and assessing a risk are complete, it is imperative that it is subject to regular review. Ongoing management and review of a risk is the most important part of the process as maintaining or reducing the risk score to within an acceptable level assures the overall management of the organisation’s risk profile. 10.22 During a risk review, the risk is re-assessed. If it is identified that the risk continues to exist, the list of current controls and further controls required must be checked, cross- referenced and added to where necessary. On the basis of progress with controls and an assessment of the risk environment, a re-assessment of the current score must be made using the risk assessment matrix. This will show whether the risk is decreasing, increasing or remaining static. Depending on its escalation level, a change to risk score will be reported at the Audit Committee. 10.23 Risk Reporting A quarterly risk management report is presented to the Audit Committee which reports on the Council’s strategic risks. In addition, the Council Management Team is provided with a regular risk management report on strategic and organisational risks. The Strategic Risk & Resilience Group provides recommendations to the Council Management Team on the escalation, de-escalation and closure of strategic level risks. Directorates and services undertake quarterly review, monitoring and reporting on their risk registers (supported by the risk management function), in order to ensure that risks are identified and escalated to the appropriate level at an early stage. 11. Review 11.1 This Risk Management Policy will be reviewed every two years and presented to CMT Page 83 of 128
Page 84
Midlothian Council Risk Management Policy & Strategy 2025 for approval. Name of Document Risk Management Policy and Strategy Author Place Policy Ownership Chief Officer Place Unit Responsible Protective Services Approved by and date Assigned Review Period 2 years from approval date Date of Next Review September 2027 (subject to Audit Committee approval) Policy Lead Senior Manager, Protective Services Page 84 of 128
Page 85
Midlothian Council Risk Management Policy & Strategy 2025 Appendix A Page 85 of 128
Page 86
Page 86 of 128
Page 87
Audit Committee Tuesday 30 September 2025 Item No 5.7 Strategic Risk Management– Strategic Risk Profile Quarter 1, 2025-26 Report by Derek Oliver, Chief Officer Place Report for Information 1 Recommendations Audit Committee is recommended to: Note the current risk landscape and organisational response to the most significant risks in Quarter 1, 2025-26 (1st April to 30th June 2025). 2 Purpose of Report/Executive Summary The purpose of this report is to provide Audit Committee with: An update on the risk responses Midlothian Council has implemented during Q1 2025/26 to respond to the current risk climate Assurance that Midlothian Council took a proportionate and planned approach to prepare and respond to the current risk climate The risk evaluation of current strategic risks and opportunities for the Council 10 September 2025 Report Contact: Derek Oliver, Chief Officer Place Derek.Oliver@midlothian.gov.uk Page 87 of 128
Page 88
3 Q1 Risk Management Overview 3.1 Midlothian Council has delivered a wide range of services to the people of Midlothian throughout Quarter 1, 2025-26. 3.2 The Council continues to manage and review risks recorded within the Strategic Risk Profile. The work required to maintain the necessary corporate oversight over the broader strategic landscape continues through the Risk and Resilience Chief Officer Group and Corporate Management Team (CMT). 3.3 Audit Committee should note that there were no new risks added from the previous Quarter however, as per the request from Audit Committee, the Strategic Opportunities section was revised to include Strategic Projects. The Projects included have a Red category across their respective Risk Evaluation. Updates on actions taken are included in the full strategic risk profile (Appendix B). 3.4 Strategic Risk Profile (SRP) The SRP is split into three sections: Strategic Issues Strategic Risks Opportunities 3.5 STRATEGIC ISSUES - SUMMARY Strategic issues Likelihood Impact Score Evaluation Q1 Q4 The Change Programme 5 5 25 Critical Critical Financial Sustainability 5 5 25 Critical Critical 3.6 The Change Programme The Change Programme remains evaluated at Critical. The financial challenges of the forecasted budget gap pose a significant challenge for benefits realisation. Council agreed to a Transformation Blueprint in June 2023 which is a 5-year transformation plan. 3.7 Financial Sustainability The scale of the financial challenge continues to be reported to the Business Transformation Steering Group and Council. Page 88 of 128
Page 89
3.8 STRATEGIC RISKS – SUMMARY EvaluationStrategic Risks Likelihood Impact Score Q1 25-26 Q4 24-25 Financial Sustainability in Future Years 5 5 25 Critical Critical The Long-Term Change Programme 5 5 25 Critical Critical Legal and Regulatory compliance 5 5 25 Critical Critical Climate Change 5 5 25 Critical Critical Emergency Planning and Business Continuity 4 5 20 High Medium Growing Council 4 4 16 High High Scottish Child Abuse Inquiry 4 4 16 High High Health & Safety/Fire Safety 4 4 16 High Medium Asset Management 3 5 15 Medium Medium Cost of Living Crisis 3 5 15 Medium Medium Cyber Security 3 5 15 Medium Medium Counter Terrorism 3 4 12 Medium Employee Performance 3 4 12 Medium Medium Care at Home 3 4 12 Medium Medium Governance and Standards 2 4 8 Low Low Internal Control Environment 2 3 6 Low Low Corporate Policies and Strategies 2 3 6 Low Low 3.9 STRATEGIC RISKS – RATED CRITICAL/HIGH 3.10 Financial Sustainability in future years The scale of the financial challenge continues to be reported to Business Transformation Steering Group and Council. Page 89 of 128
Page 90
3.11 The Long-Term Change Programme The Change Programme has remained at Critical for the last 2 years. The financial challenges of the underlying budget gap pose a significant challenge. Council agreed to a Transformation Blueprint in June 2023 which is a 5-year transformation plan. 3.12 Legal and Regulatory compliance Significant resourcing pressures have impacted on risk evaluation. Work is ongoing with the Scottish Information Commissioner and National Records of Scotland to develop and deliver improvement plans. 3.13 Climate Change Councillors were presented with a briefing on the Climate Action Plan in Q2 24-25 as committed to through the Transformation Blueprint. With a report presented to October Council, Councillors approved, given the challenges (particularly financial), the realignment of the target deadline of 2030 for net zero emissions from the Midlothian Council estate to 2045. In light of this, a refresh of the Council’s Climate Change Strategy, approved by Council in August 2020, is progressing. 3.14 Emergency Planning and Business Continuity Ongoing monitoring of a changing landscape and maintaining organisational readiness and preparedness. Increase in evaluation score aligned to internal audit of Risk Management, specifically in relation to a focus on resource, service risk registers and business continuity planning, as previously reported to Committee. This work is progressing. 3.15 Growing Council The risk evaluation remains High in Q1 2025-26. This is in response to the current financial challenge as described above and the increased pressure the Council faces with growth. Some current examples of this include: Inflationary impact on the delivery of the capital programme Cost of living crisis Pressure on the care sector as people are living longer and require more care provision General population growth places additional demand on infrastructure such as GPs, schools, waste services etc. 3.16 Scottish Child Abuse Inquiry (SCAI) The SCAI risk evaluation remains High as the Inquiry continues. Page 90 of 128
Page 91
3.17 Health & Safety/Fire Safety Reviewing Fire Safety audits continue across our estate. Estate Safety & Maintenance Groups refreshed to identify and action any priority safety or repairs matters. 3.18 STRATEGIC OPPORTUNITIES 3.19 Capital Projects - Housing Projects impacted with 26% reduction in Affordable Housing Supply Programme grant to Midlothian and continued high build costs. Phase 5 housing programme has been reviewed to ensure affordability within the Housing Revenue Account, allowing for reduced levels of grant. Projects highlighted with specific Red Risk Evaluation(s) and detailed within the SRP are Newbyres, Gorebridge; Edmonstone Road, Shawfair and Newton Church Road, Danderhall. 3.20 Capital Projects – Transport, Net Zero & Infrastructure Cost of delivering enabling infrastructure projects has risen, resulting in significant funding gap emerging and impacting on progress of A701 Relief Road, Sustainable Transport Corridor and Straiton Junction Improvements, which are detailed within the SRP. 3.21 Capital Projects – Children, Young People & Partnerships Estates Programme: Primary Five specific projects identified within the SRP: 1. Mayfield/St Lukes PS New Build: Tender return from Stage 1 exceeds available budget. Programme delayed for project revision. 2. Kings Park PS Extension & Refurbishment: No available budget to undertake extension. Condition and suitability of school to be addressed. 3. Rosewell PS Extension: No available budget to undertake extension. Condition and suitability of school to be addressed. 4. Mauricewood PS Extension & Refurbishment: Rising roll and catchment review requires investment in school to address capacity and suitability. Limited budget available. Design team appointed to develop investment in school that aligns with budget available from Developer Contributions. 5. Bilston PS Extension: Rising roll and catchment review requires investment in school to address capacity and suitability. Limited budget available. Design team appointed to develop investment in school that aligns with budget available from Developer Contributions. Page 91 of 128
Page 92
3.22 Capital Projects – Children, Young People & Partnerships Estates Programme: Secondary Three specific projects identified within the SRP: 1. Beeslack HS Replacement: Contractor appointment delayed. Programme behind due to changes in scope / design. 2. Shawfair All Through: Site acquisition complete. School location fixed with design team. Remediation programme being revised. Seeking to make efficiencies in remediation programme. 3. Penicuik HS New Build: LEIP target for delivery is Dec 2026, however programme for occupation is July 2027. Cost reports tracking higher and risks identified in refurbishment works. SFT advising if additional LEIP funding available. 3.23 Capital Projects – Regeneration Three specific projects identified within the SRP: 1. Vogrie Changing Places: now progressing following contractor issues. 2. Destination Hillend: Alpine Coaster delivered with access and parking infrastructure. Project absorbed risk and contingency. Delays to delivery resulting from issues with access / water mains. Main Building tender return exceeded budget. Next Phase to be recast. Interim works on water supply and drainage required. 3. Hopefield Industrial Estate: Updated financial model required. 3.24 City Region Deal Edinburgh and South East Scotland City Region Deal - bid for funding to Scottish and UK Governments to accelerate economic growth through investment in infrastructure/ housing/ skills and innovation was agreed by Council in June 2018. Projects continue to be progressed with realisation of regional enhancements and connectivity. Page 92 of 128
Page 93
4 Report Implications (Resource, Digital and Risk) 4.1 Resource There are no direct resource implications indicated in this report, although individual risks have associated resource implications. 4.2 Digital None 4.3 Risk The risks reported in this report are understood with the Council able to demonstrate the current risk controls and actions being taken in response to these. The report provides an overview of the significant risks faced by the Council during Quarter 1 2025-26 and should act to provide assurance that Midlothian Council took a proportionate and planned approach to prepare and respond to each of these risks. 4.4 Ensuring Equalities (if required a separate IIA must be completed) There are no direct equalities issues arising from this report. 4.5 Additional Report Implications (See Appendix A) See Appendix A Appendices Appendix A – Additional Report Implications Appendix B – Strategic Risk Profile (Quarter 1, 2025-26) Page 93 of 128
Page 94
APPENDIX A – Report Implications A.1 Key Priorities within the Single Midlothian Plan This report provides an overview of the Strategic Risk Profile of Midlothian Council at a defined point in time. The issues, risks and opportunities affecting or supporting delivery of the council priorities are set out within the Strategic Risk Profile. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious None of the above A.4 Delivering Best Value The Council’s commitment to best value and securing continuous improvement can best be delivered when decisions are made against a backdrop of understanding the risks and opportunities before an organisation. This report seeks to provide assurance that the current risk environment is understood and that Midlothian Council is taking appropriate action in response to those identified risks. A.5 Involving Communities and Other Stakeholders This Strategic Risk Profile report has been compiled with input from a range of internal key stakeholders. Page 94 of 128
Page 95
A.6 Impact on Performance and Outcomes This report seeks to provide an overview of the challenging risk environment within which the Council is operating at this time. Being in a risk aware position helps to inform current and future decision making, with the intention of enhancing decision making and the associated performance and outcomes which flow from well informed decision making. A.7 Adopting a Preventative Approach The Risk Management approach being taken by the Council is founded on a preventative approach to managing risks, where appropriate and more generally to decision making with far greater risk awareness. A.8 Supporting Sustainable Development Senior Managers must ensure the sustainability of the Council, which entails identifying, understanding and managing Strategic and Service level risks and opportunities. Page 95 of 128
Page 96
Page 96 of 128
Page 97
1 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 STRATEGIC RISK PROFILE, Q1 April - June 2025 STRATEGIC RISK PROFILE SRP This risk register captures the main strategic issues, risks and opportunities that are corporate in nature. It identifies the nature of the risks, measures required to control the risks and their evaluation. It also details what further actions are required to reduce the likelihood and impacts of those risks to more acceptable and manageable levels with timescales. Strategic Issues SRP.IR.02 The Change Programme Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.IR. 02 Risk cause The pace of transformation strands of activity, reporting to the Business Transformation Board, does not secure service transformation, delivery of outcomes or benefit realisation. Risk event Delayed progress or non-achievement of outcomes and benefits. Risk effect Slow or delayed financial benefits arising from service redesign, requiring the adoption of recovery plans or requiring short term service reductions which impact on the Council’s ability to deliver against its priorities. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 1. Transformation Blueprint agreed at Council June 2023 which is a 5- year transformation plan. Revised governance for transformation agreed and revised Terms of Reference in place for the Business Transformation Board to oversee progress on change programme. 2. Regular reporting to Council setting out scale of financial challenge ahead with recurring expenditure for current service delivery projected to exceed recurring income. 3. Cross Party Business Transformation Steering Group are given updates on the progress of the Transformation programme. 4. Financial monitoring reports and work of the Corporate Management Team evidence continued financial sustainability, in so far as services are delivered within the overall budget in year. 5 5 Page 97 of 128
Page 98
2 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Related Action Code Related Action Related action latest note Managed By Due Date Status SPR.RA -02.08 Transformation Blueprint 2023-28 delivery Q1 25/26: As per previous quarters Q4 24/25: As Q3 24/25 Q3 24/25: As Q2 24/25. Q2 24/25: Progress with sprints is reported to BTB at every meeting via the dashboard and also in detailed reports at some points. BTSG are provided with an updated dashboard every cycle and receive focused reports on individual sprints and also funding requests to release BT funds to support project work. Q1 24/25: As Q4 23/24. Chief *Executive; Chief Officer *Place; Chief Officer Corporate Solutions; Chief Finance Officer; 30-Jun-2028 20% SRP.RA .02.03 Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q1 25/26: Updated MTFS projections to 2028/29 were presented to Council in June 2025. A further update will be provided in quarter 3 of 25/26. Q4 24/25: MTFS projections to 2028/29 were presented to Council in February 2025 as part of setting the 2025/26 budget and accompanying Council Tax levels. A further update will be provided to Council during Q1 of 25/26. Q3 24/25: An update on the MTFS was presented to Council in December along with outcomes from the public consultation. Detailed analysis of emerging national budget positions for 2025/26 was presented and discussed at the Business Transformation Group. Q2 24/25: Further update on the MTFS was presented to Council in October and a public consultation was launched on 9th October running to 20th November. Q1 24/25: An update on the MTFS was presented to Council in June 2024. This identifies immediate actions required, in addition to those in the Transformation Blueprint, to bridge the gap between recurring expenditure and recurring income and to allow the setting of a balanced budget for 2025/26. Chief *Executive; Chief Finance Officer; 30-June-2024 100% Page 98 of 128
Page 99
3 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 SRP.IR.07 Financial Sustainability Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.IR. 07 Risk cause Scottish Government Grant settlements fall short of the resources needed to sustain core services. Core funding falling short of inflation pressures, pay awards and demographic pressures arising from an Increasing ageing population of over 75’s. Increasing population of 0-15 age group and at a time when there are rising customer expectations. Risk event Transformation activity and the flexibility available to Councils as part of the grant settlement does not address future years projected budget gaps. Risk effect Inadequate government funding makes securing balanced budgets challenging. This in turn erodes the Council’s ability to deliver services to the community and potentially means that resources available fall short of those the Council assess as required to meet its statutory obligations. Whilst transformation activity can help reshape services and ensure best value in the delivery of services it is not a solution to continued erosion of core funding. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 1. There is an approved Capital Strategy and Reserves Strategy in place. The Capital Strategy is being updated in the context of ongoing and significant infrastructure pressures. 2. There is an approved budget for 2024/25. Services are delivered within the totality of that budget. 3. Enhanced monitoring arrangements have been agreed for service areas that are regularly showing overspends. 4. Directorates have budget boards in place to monitor and agree actions for those items which are identified as needing specific attention or present a risk to the financial position of services. 5. Strategic Boards in place and BTB focus and attention on driving transformation to support future year’s financial sustainability. 6. Working through COSLA to influence government spending decisions to influence Scottish Government’s budget allocation to Councils. 7. Capital Plan and Asset Management Board will scrutinise and challenge slippage on capital programmes recognising that slippage can have an adverse impact on financial sustainability and also the delivery on assets required to support capital growth. 8. Chief Executive continues to emphasise the need for effective financial control and underlined the benefit to the organisation of such an approach. 9. Scottish Governments May 2022 Resource Spending Review provided planning parameters for term of parliament, albeit these are challenging and present a real terms reduction in grant funding of circa 7% over the period. 10. Report to Council February 2024 sets out scale of financial challenge ahead with recurring expenditure for current service delivery projected to exceed recurring income. Updated MTFS projections presented in June 2024 with a further update presented in February 2025. 11. Cross Party Business Transformation Steering Group engaged in consideration of measures to secure balanced budgets alongside the development of a Strategic Plan to support decisions about what services, beyond those which are statutory can be provided. 12. Income Generation 5 5 Related Action Code Related Action Related action latest note Managed By Due Date Status SPR.RA -02.09 Transformation Blueprint 2023 to 2028 Q1 25/26: Refer to SRP.RA-02.08 Q4 24/25: Refer to SRP.RA-02.08 Chief *Executive; Chief Finance Officer; 30-Jun-2024 20% Page 99 of 128
Page 100
4 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Q3 24/25: Refer to SRP.RA-02.08 Q2 24/25: Refer to SRP.RA-02.08 Q1 24/25: As Q4 23/24. SRP.RA .02.03 Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q1 25/26: Refer to SRA.RA-02.03 Q4 24/25: Refer to SRP.RA-02.03 Q3 24/25: Refer to SPR.RA-02.03 Q2 24/25: Refer to SPR.RA-02.03 Q1 24/25: An update on the MTFS was presented to Council in June 2024. This identifies immediate actions required, in addition to those in the Transformation Blueprint, to bridge the gap between recurring expenditure and recurring income and to allow the setting of a balanced budget for 2025/26. Chief *Executive; Chief Finance Officer; 30-June-2024 100% SRP.RA -02.10 Capital Plan Prioritisation Q1 25/26: Work evaluating information flowing from building condition surveys continues with a view to presenting a draft building Asset Management Plan to Council in October. Q4 24/25: Council in February received an update on Capital Plan Prioritisation work and made a decision on an updated Learning Estate Strategy. The extent and affordability of work flowing from building condition surveys is being assessed and will be concluded and reported to Elected Members early in 2025/26. Q3 24/25: Work continues on Capital Plan Prioritisation Q2 24/25: Work continues on Capital Plan prioritisation Q1 24/25: Work continues on Capital Plan prioritisation Chief Finance Officer; Executive Director – Place; Executive Director - Education 31-Oct-2024 0% Page 100 of 128
Page 101
5 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Strategic Risks SRP.RR.01 Financial Sustainability in Future Years Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.01 Risk cause: Scottish Government Grant settlements fall short of the resources needed to sustain core services. Core funding falling short of inflation pressures, pay awards and demographic pressures arising from an Increasing ageing population of over 75’s. Increasing population of 0-15 age group and at a time when there are rising customer expectations. Policy decisions by UK & Scottish Governments which are not fully funded. Changes to the responsibilities of Local Government and the funding implication that arise from that, particularly in respect of the creation of a National Care Service. Future year pay award settlements. Risk event: Real terms reduction in core grant settlements. Policies decisions at Government level not fully funded to Council's. Implementation of a National Care Service and impact on grant settlements. Securing the extent of change required in order to deliver financial sustainability and a change program that recognises the size of the challenge. Cost pressures exceeding budget estimates. Risk to not achieving financial sustainability is a failure to deliver cost reductions / service change embedded in the blueprint and also supplementing the blueprint. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 1. Development of Strategic Plan, Transformation Blueprint and MTFS projections which come together to provide a framework to effect change and to move the Council to a position of financial sustainability. 2. Maintaining a level of reserves to deal with unforeseen or one-off cost pressures. 3. Capital and Reserves Strategies in place. The Capital Strategy is being updated in the context of ongoing and significant infrastructure pressures. 4. Working through COSLA to influence government spending decisions to influence Scottish Government’s budget allocation to Councils. 5. Implement a lobbying strategy with government to recognise the unique position Midlothian Council is in. 6. Best Value Audit report actions. 7. Strategic Boards in place to drive transformation in line with the Transformation Blueprint. 8. Dedicating capacity to understand impact of NCS Bill, but limited details mean this is challenging and many unanswered questions (refer to specific risk on NCS for further detail). 5 5 Page 101 of 128
Page 102
6 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .02.03 Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q1 25/26: Refer to SRP.RA-02.03 Q4 24/25: Refer to SRP.RA-02.03 Q3 24/25: Refer to SRP.RA-02.03 Q2 24/25: Refer to SRP.RA-02.03 Q1 24/25: An update on the MTFS was presented to Council in June 2024. This identifies immediate actions required, in addition to those in the Transformation Blueprint, to bridge the gap between recurring expenditure and recurring income and to allow the setting of a balanced budget for 2025/26. Chief *Executive; Chief Finance Officer; 30-June-2024 100% SRP.RA .02.04 Transformation Blueprint 2023 to 2028 Q1 25/26: Refer to SRP.RA-02.08 Q4 24/25: Refer to SRP.RA-02.08 Q3 24/25: Refer to SRP.RA-02.08 Q2 24/25: Refer to SRP.RA-02.08 Q1 24/25: As Q4 23/24. Chief *Executive; Chief Finance Officer; 30-Jun-2028 20% SRP.RA .02.06 Capital Plan prioritisation Q1 25/26: Work evaluating information flowing from building condition surveys continues with a view to presenting a draft building Asset Management Plan to Council in October. Q4 24/25: Council in February received an update on Capital Plan Prioritisation work and made a decision on an updated Learning Estate Strategy. The extent and affordability of work flowing from building condition surveys is being assessed and will be concluded and reported to Elected Members early in 2025/26. Q3 24/25: Work continues on Capital Plan Prioritisation Q2 24/25: Work continues on Capital Plan prioritisation Q1 24/25: Work continues on Capital Plan prioritisation Head of *Development; Executive Director *Place; Chief Finance Officer; 31-Oct-2024 0% Page 102 of 128
Page 103
7 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 SRP.RR.02 The Long-Term Change Programme Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.02 Risk cause: A MTFS that does not address the projected budget shortfall or contextual factors relating to the Midlothian area. Reduced resources Leadership fit for the future. Lack of clarity or clear compelling vision for the future Delay or shortfall in securing savings Lack of or not securing transformational change in service provision Risk event: Delayed progress in applying various strands of the Change Programme including Delivering Excellence Framework Slow benefits realisation and budget savings. Cuts in service provision rather than service transformation Risk effect: Objectives of change not actually met or progress too slow. Adverse impact on services Slow or delayed proposals/savings arising from service redesign. Potentially further eroding reserves or requiring short term service reductions which impact on Council's ability to deliver against its priorities. Staff morale negatively affected, Government step-in short term savings instead of transformation Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 1. Development of Strategic Plan, Transformation Blueprint and MTFS projections which come together to provide a framework to effect change and to move the Council to a position of financial sustainability. 2. Leadership from all Elected Members, Executive Team and Senior Leadership Group. 3. Appropriate governance in place across the BTB Strategic Boards 4. Resilience planning. 5. Capacity to deliver change. 6. Dedicating capacity to understand impact of NCS Bill, but limited details mean this is challenging and many unanswered questions (refer to specific risk for NCS Billl). 7. High level priority is given to blueprint work. 5 5 Page 103 of 128
Page 104
8 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .02.03 Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q1 24/25: Refer to SPR.RA-02.03 Q4 24/25: Refer to SPR.RA-02.03 Q3 24/25: Refer to SPR.RA-02.03 Q2 24/25: Refer to SPR.RA-02.03 Q1 24/25: An update on the MTFS was presented to Council in June 2024. This identifies immediate actions required, in addition to those in the Transformation Blueprint, to bridge the gap between recurring expenditure and recurring income and to allow the setting of a balanced budget for 2025/26. Chief *Executive; Chief Finance Officer; 30-June-2024 100% SRP.RA .02.04 Transformation Blueprint 2023 to 2028 Q1 25/26: Refer to SRP.RA-02.08 Q4 24/25: Refer to SRP.RA-02.08 Q3 24/25: Refer to SRP.RA-02.08 Q2 24/25: Refer to SRP.RA-02.08 Q1 24/25: As Q4 23/24. Chief *Executive; Chief Finance Officer; 30-Jun-2028 20% SRP.RR.03 Legal and Regulatory Compliance Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.03 Risk cause Current or new legislation applying to Midlothian Council. Lack of capacity to resource statutory obligations around GDPR, data protection, records management, information requests and statutory regulatory functions. Risk event Head of *Adult and Social Care; Legal *and Governance Manager; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive 1. Executive Directors, Chief Officer(s) and Head(s) of Service responsible for identifying applicable legislation and propose Council or Service responses to CMT and Cabinet/Council as required. 2. Annual Assurance Statement. 3. Internal Audit testing of internal controls as part of risk-based audit plan. 4. External Audit. 5. Range of external inspection. 6. BTSG oversight of new legislation 7. Central repository of applicable legislation. 5 5 Page 104 of 128
Page 105
9 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Council and or Services not identifying all applicable legislation impacting Council activities and Service requirements. Risk effect Council failing to meet its statutory obligations resulting in a potential negative impact for service users or employees. Reputational impact of not meeting statutory obligations. Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .03.02 Rights of the Child Bill Q1 24/25: Bill now adopted. Policy to be presented to Council May/June 2024. Council wide group established and developing a plan that ensures we are all aware and adhering to UNCRC. Executive Director – People 31-Dec-2024 0% SRP.RA .03.03 National Care Service Q3 24/25: Scottish Government announced in January 2025 that they will not be proceeding with the National Care Service. Q2 24/25: As of 14 November 2024, the Scottish Government has paused legislation on the creation of a NCS. Chief *Executive; 31-Dec-2024 0% SRP.RA .03.05 Review of Standing Orders, Scheme of Administration and Scheme of Delegation Q4 24/25: Standing Orders and Scheme of Administration updated and approved at Feb 2025 Council Legal & Governance Manager; Executive Director *Place; Chief Officer Corporate Solutions; 28 Feb 2027 40% SRP.RA .03.07 Review of policy and creation of a policy register Q1 25/26: Engagement sessions taking place with each Directorate to review policy register Q4 24/25: Policy list presented to CMT May 2025 for CMT to review and feedback. Chief Officer Corporate Solutions 31-Dec-2025 40% NEW Compliance with statutory duties Q1 25/26: Progress Update Review for Records Management Plan submitted and approved by National Records of Scotland and published online. Compliance Team establishment ongoing. Strategic Information Governance Group established and Action Plan in development. Q4 24/25 : Resourcing proposal for a new Compliance Team being agreed by Corporate Management Team. Funding to be identified through existing Chief Officer Corporate Solutions, Legal and Governance Manager 31-Dec-2025 10% Page 105 of 128
Page 106
10 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Corporate Solutions budgets with implementation on a phased basis. Now proceeding to final stages of Managing Change process. Q1 24/25: Records Management Officer in post and reviewing the Records Management Plan, Corporate Retention Policy and Schedule and supporting the development of retention framework for M365 rollout. SRP.RR.13 Climate Change Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.13 Risk cause Council Services not adequately engaged, resourced or directed to fulfil the requirements of the Climate Change Act. Risk event Council Services not responding to the Climate Change Act with sufficient pace. Risk effect Council failing to meet its obligation under the Climate Change (Scotland) Act 2009 and incurring the associated reputational damage. Chief *Executive; Executive Directors and Chief Officers. 1. Statutory requirement to report on compliance with climate change duties. 2. Council Carbon Management Plan 3. Approval of a Corporate Climate Change Strategy and action plan 4. CPP Board for Climate Change to bring strategic focus and oversight of plans and progress. 5. Resilience Seminars 5 5 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .13.04 Delivery of the BTB Board Carbon Neutral by 2030 Q1 25/26: Work continues on revised Climate Action Plan/Strategy. Q3 24/25: Council approved realignment of Net Zero target from 2030 to 2045. Q2 24/25: Member Briefing delivered. Q1 24/25: Member Briefing on Climate Action Plan being prepared for presentation in Q2/3. Planning, Sustainable Growth and Investment *Manager; Chief Officer *Place; 31-Mar-2030 0% SRP.RA .13.05 Development of the Strategic Plan 2023- 27 Q3 24/25: Council approved realignment of Net Zero target from 2030 to 2045. Climate Action Strategy refresh to follow. Planning, Sustainable Growth and 31-Mar-2025 90% Page 106 of 128
Page 107
11 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Investment *Manager; Chief Officer *Place; SRP.RR.09 Emergency Planning and Business Continuity Management Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.09 Risk cause The Council not preparing or timeously reviewing Emergency Plans and testing arrangements to respond to Civil Contingencies Incidents. Risk event There are a wide range of potential events the Council may be expected to respond to e.g., Severe weather incident, Pandemic, Utility disruption etc. Risk effect Loss or degration of service. Loss or damage to buildings. Not adequately able to recover from the losses, (e.g. staff, major facility such as secondary school, main offices or computer systems etc). Not able to respond competently to a major emergency in the community. Unnecessary loss of life, livelihoods and property due to inadequacy or response. Reputational consequences and damage. Prosecution through non-compliance with the Civil Contingencies Act. Fatal Accident Inquiries. Costs. Head of *Adult and Social Care; Head of *Development; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; David Robertson; Chief Officer Young People and Partnerships 1. Civil Contingencies Risk Register used to highlight key risks and record response, - Council’s plans developed and maintained in response to identified risks, - Risk and Resilience Group support development, peer review and roll out of plans. 2. Establishment based incident response plans in place and maintained locally. 3. Emergency response plan setting out general approach to respond to a major emergency in-line with key partner organisations. 4. As part of the Council’s Emergency response the importance of recording decisions made and information available at the time is highlighted as this would be scrutinised in the event of an FAI. 05 – Care for People Group: Afghan, Ukrainian and UASC support programmes 4 5 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .09.02 Development of Emergency Plans Q1 25/26: As Q4 24/25. The service review for the Health, Safety and Resilience Team Service, which includes Contingency Planning, requires to progress to implementation stage. Chief Officer *Place; Senior Manager 31 March 2026 25% Page 107 of 128
Page 108
12 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Plans and Procedures updated. Business Continuity (BC) Planning inclusive of cyber security. BCP template provided for service completion. CONTEST/Prevent: Mandatory Prevent e-learning module updated to link direct to Home Office Prevent product. This went live in April 2025. Action Counters Terrorism (ACT) Awareness e-learning added to the LearnPro course list for corporate staff in April 2025 Ongoing monitoring and circulation of information and liaison with services regarding the Public Switched Telephone Network switch-off (in conjunction with Digital Services) and the Radio Teleswitch Service switch-off, linking with the Third Sector Interface and Neighbourhood Watch Scotland (the latter having been contracted by BT and E-on to deliver face to face public information sessions on these topics). Training and Exercising: preparation for national pandemic exercise scheduled for Autumn 2025, involving Scottish resilience partnerships. Participation in the Torness annual call-out exercise. Three members of staff (from both Directorates and HSCP) attended Crisis Management training offered by Scottish Government during this quarter. Participated in familiarisation training for the Resilience Direct platform as well as promulgating opportunities to all Midlothian RD user account holders. Protective Services; David Robertson SRP.RA .09.03 Business Continuity Software System Q1 25/26: As Q4 24/25 Q4 24/25: Consideration currently being given to the option of using Teams/Sharepoint as a solution/replacement for existing software, the contract for which ends in Dec 2025. Q3 24/25: Any new system requires resource to roll out across the organisation. Q1 24/25: The Health, Safety & Resilience Service review is progressing and has identified staffing shortages to meet obligations. Chief Officer *Place; Senior Manager Protective Services; David Robertson 31-Dec-2025 25% Page 108 of 128
Page 109
13 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 SRP.RR.16 Growing Council Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.16 Risk cause Population growth in Midlothian over the next 10 to 15 years will see Midlothian become the fastest growing Council in Scotland. Between 2014 and 2039, ages 0-15yrs, population is projected to increase by 20% and for ages 75+ population projected to increase by 100%. Risk event Failure to resource and plan for these rises will significantly impact the Councils ability to fulfil its statutory obligations in relation to these groups. Risk effect Inadequate capacity within the school estate to cope with the projected increase in pupil numbers. In sufficient provision to support an aging population placing costly inefficiencies on other parts of the care sector. General population increase placing additional demand on infrastructure including GP services. Increased pressure on infrastructure, services e.g., waste collection and growth of road network as new development roads are adopted. Head of *Adult and Social Care; Chief *Executive; Executive Director *Place; Fiona *Robertson; Chief Officer Young People and Partnerships 1. Local development plan and supplementary guidance on developer contributions. 2. Services planning future service provision on the basis of anticipated service demands 3. The change programme 4. Learning Estate Strategy 5. Capital Plan Prioritisation 6. Strategic Housing Investment Strategy 7. Rent Review Strategy 8. Joint needs assessment used to develop - IJB Strategic Plan 9. Capital Plan and Asset Management Board will scrutinise and challenge slippage on capital programmes recognising that slippage can have an adverse impact on financial sustainability and also the delivery on assets required to support capital growth. 10. City Deal provides the opportunity to support inclusive growth. 4 4 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .02.06 Capital Plan prioritisation Q1 25/26: Work evaluating information flowing from building condition surveys continues with a view to presenting a draft building Asset Management Plan to Council in October. Q4 24/25: Council in February received an update on Capital Plan Prioritisation work and made a decision on an updated Learning Estate Strategy. The extent and affordability of work flowing from building condition surveys is being Head of *Development; Executive Director *Place; Chief Finance Officer; 31-Oct-2024 75% Page 109 of 128
Page 110
14 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 assessed and will be concluded and reported to Elected Members early in 2025/26. Q3 24/25: Work continues on Capital Plan prioritisation. Q2 24/25: Work continues on Capital Plan prioritisation. Q1 24/25: Work continues on Capital Plan prioritisation. SRP.RR.14.1 Scottish Child Abuse Inquiry Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.14.1 Risk Cause: Midlothian Council and its legacy organisations, predating the creation of Midlothian Council in 1996, have been involved in the provision of care of children going back to living memory. During this time there is the likelihood that the care children received fell below standards of care now in place. There is the further potential that some people in the care of Midlothian Council and its legacy organisations were subject to abuse by those who were employed to care for them. Risk Event: The Scottish Government began an Inquiry into cases of Child Abuse occurring prior to 17 December 2014, the intention of this enquiry is to identify historic case of abuse which have to date gone unreported. The most recent Section 21 notice around the Foster Care Case Study is a significant piece of work. The request for information from 1930 to date is very challenging given the volume of files that require to be read and analysed. Risk Effect: If the inquiry finds historic cases of abuse in Midlothian this could damage the reputation of the Council and could place doubt in the eyes of the public Chief *Executive; Chief *Social Work Officer The Council initially set up an Inquiry Project Team, however this is no longer required as we have an experienced worker overseeing all requests for the Scottish Child Abuse Inquiry Team. Work is ongoing and we have the additional tasks of supporting and responding to enquiries from the redress team. The Inquiry Team have established a Project Plan covering: 1. Residential establishments, List D Schools and Foster Carers: identifying Children’s homes, Foster Carers and any List D Schools in Midlothian over the last 100 years and researching historic records. 2. Record Audit: reviewing the Council’s existing paper and electronic recordkeeping systems to identify relevant records and map them to residential establishments. This also includes, where possible, noting the Council’s historic recordkeeping policies, such as retention schedules. 3. Cataloguing/Indexing: checking and updating existing recordkeeping systems for accuracy and consistency, enabling effective information retrieval when requested by the Inquiry. The Project Team have established a Project Plan covering: 4. Ascertaining the succession and insurance position in relation to potential historic child abuse claims. 5. Ascertaining and agreeing Midlothian Council’s legal position/ approach in dealing with the potential historic child abuse claims. 6. Identifying the need for guidance, protocol, templates etc. should/if any claims be made against the council. 7. Consideration to identifying if additional staffing will be required as expected deluge of FOI’s SARs in 2018 from solicitors of potential claimants. 4 4 Page 110 of 128
Page 111
15 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 as to the safety of these currently in care. There is significant scope for a substantial financial impact arising from claims of historic abuse. Some existing employees may be affected by the inquiry and subsequent claims of abuse. We have requested an extension for Parts B, C & D of the last Section 21 to April 2020, which has been granted. To date there has been no evidence from the extensive file read to suggest there has been systemic abuse within our foster care system. 8. Project team is in place with project plan with a range of identified actions which are being progressed. Monthly meetings to progress project plan. 9. The SCAI Social Worker is very competent and experienced in this area of work and provides quarterly updates on their findings from the file read. This is a real strength within this area of work. The CSWO and Principal Solicitor meet regularly with the social worker to discuss findings from the file read. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .14.03 Foster Care and Residential Care File Review Q3 24/25: Phase 10 is now in progress with investigation of residential care homes run by local authorities. We will comply with all s21 requests. Childrens Services Management Team; Chief *Social Work Officer; Chief Officer Young People and Partnerships 31-Mar-2024 100% SRP.RR.19 Health & Safety/Fire Safety Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.19 Risk cause Failing to identify and rectify non- compliance with Health and Safety regulations. Risk event Reactive rather than pro-active organisational health and safety culture. Employees/Managers not adequately trained. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; 1. Health Safety and Wellbeing Strategy & Service Plan. 2. Suite of Health and Safety Management Arrangements developed setting out council response to statutory obligations. 3. Comprehensive range of Health & Safety Management & Assessment based development opportunities for line managers. 4. Use of Health & Safety Management Information System (SPHERA) to enhance information transfer and organisational efficiency. 5. Comprehensive training programme in place to support those with responsibility for managing health and safety. 6. Use of comprehensive audit programme to confirm the application of agreed management Arrangements and Council Policy. 4 4 Page 111 of 128
Page 112
16 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Employees required to undertake tasks in which they are not trained or competent. Statutorily driven health and safety protective arrangements for service users and employees not implemented correctly. Non-compliance with policy and procedure. Health and safety team inadequately resourced to promote or implement pro- active measures or train managers/staff. Audits and inspections to being undertaken to confirm adherence to policy and legislative requirements. Risk effect Serious injury or ill health impact on employees and/or service users. Negative impact on outcomes for customers and service users. Service users and employees exposed to hazards where statutory requirements exist. Statutory health and safety - duty of care to services users and employees not met. Criminal prosecution of the Corporate body and or individuals through Corporate Homicide (Corporate Manslaughter). Significant financial penalties from Criminal Prosecution. Reputational damage. Significant costs incurred to Council due to insurance claims, loss of services, plant or buildings. Chief Officer Corporate Solutions; Chief Finance Officer; David Robertson; Chief Officer Young People and Partnerships 7. Estate Safety & Maintenance Groups for prioritising any matters requiring escalation. Related Action Code Related Action Related action latest note Managed By Due Date Status NEW Health, Safety & Resilience Service Review Q1 25/26: As Q4 24/25. Q4 24/25: Position unchanged from Q3 The service review for the Health, Safety and Resilience Team Service requires to progress to implementation stage. Q3 24/25: Service review completed, pending action. Chief Officer *Place; Senior Manager Protective Services; David Robertson 31/10/2025 0% Page 112 of 128
Page 113
17 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Q2 24/25: Service Review progressing and developing (completed Sept 2024). Q1 24/25: The Health, Safety & Resilience Service review is progressing and has identified staffing shortages to meet obligations. The report will be submitted in Q2 for consideration. SRP.RA .19.01 Delivery of Health, Safety and Wellbeing Service Plan Q1 25/26: As Q4 24/25. Q4 24/25: Position unchanged from Q2. Awaiting outcome before service plan for 25/26 can be fully drafted. Q3 24/25: Position unchanged from Q2. Q2 24/25: Awaiting outcome of service review before reviewing service plan. Q1 24/25: Implementation of the Protective Services Health, Safety & Resilience Service Plan continues. The plan will be reviewed at conclusion of the service review. Chief Officer *Place; Senior Manager Protective Services; David Robertson 31-Mar-2025 0% SRP.RA .19.07 H&S fire safety audit across all Council estate Q1 25/26: Fire Risk Assessment work plan started – priorities being premises with sleeping risks, schools, depots, main offices, leisure centres and libraries. Q4 24/25: New Fire Safety Adviser now recruited. To begin work on 28th April 2025. Q3 24/25: Departure of Fire Safety Adviser in Nov 2024 has adversely affected implementation of audit programme and reactive responses. Another member of staff is temporarily dealing with priority work until a replacement is recruited. Q2 25/25: As Q1 24/25. Q1 24/25: Fire Risk Assessments/Audits progressing. A number of Zurich Insurance audits have also taken place. Chief Officer *Place; Senior Manager Protective Services; David Robertson 31-Mar-2026 20% SRP.RR.08 Asset Management – Buildings, Vehicles, Roads and Digital Assets/Networks Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.08 Risk cause Head of *Adult and Social Care; 1. There is provision in place within the capital plan for investment in the asset base. 3 5 Page 113 of 128
Page 114
18 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Many of the assets the Council own by their nature are in a position of ongoing deterioration through their normal use, e.g., roads - normal wear and tear, streetlights and vehicles & buildings used to deliver services. Risk event Many assets will deteriorate under normal conditions although buildings, roads and streetlights as an example can be damaged during more extreme weather events or as a result of a lack of maintenance. Risk effect In the case of Roads Services there is a real risk of increased potholes and insurance claims, reduced skid resistance leading to higher accident potential and building up of higher costs in the future. In respect of vehicles, increased breakdowns, service failures, greater maintenance inevitable, higher short-term hire costs. In terms of property, health and safety issues arise, failure to meet current standards and higher running costs. There is also the risk of two-tier accommodation, some high quality, some low. Head of *Development; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 2. Asset register 3. Condition Survey 4. Understanding of future asset needs 5. Asset Strategy: . Roads . Land . Fleet . Digital Service Network . Digital Service hardware 6. Capital programme - investment in estate. 7. Ongoing monitoring of properties by: Maintenance Surveyors, Facilities Management and Property Users. 8. Established Capital Plan and Asset Management Board and dedicated Asset Management Board 9. Establishment of 7 thematic Estate Safety and Management Groups chaired by Chief Officer Place 10. Building Accessibility Strategy Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .08.02 Plan for appropriate investment in capital works and remedial maintenance over the lifespan of each property asset. Q1 25/26: Asset management plan for Property & Estate drafted. Due to be finalised and issued to Council in Q2. Updated governance for asset management included. Asset management plans for Fleet also approved at Council. Q3 24/25: Condition Surveys of Learning Estate (excl PPP) has concluded. Q4 presentation to Elected Members. Backlog repairs continue. Q1 24/25: Condition Surveys continue, with Learning Estate (excl PPP) expected to be concluded by end December 2024 to inform capital investment proposal. Chief Officer *Place; 30-Apr-2025 33% Page 114 of 128
Page 115
19 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 SRP.RA .08.05 Learning Estate Strategy Q1 25/26 Learning Estate Strategy Is currently being implemented with the focus on the delivery of the LEIP funded projects of Mayfield, Beeslack and Penicuik. Shawfair Campus project ahs been approved and design being developed. Learning Estate Programme Manager 30-March 2026 50% SRP.RA .08.06 Asset Management systems Q1 25/26: Asset management plan for Property & Estate drafted. Due to be finalised and issued to Council in Q2. Updated governance for asset management included. Asset management plans for Fleet also approved at Council. Also approved at Council. Q1 24/25: Identified for implementation through Transformation Blueprint and The Change Programme. Head of *Development; 31-Mar-2025 50% SRP.RR.22 Cost of Living Crisis Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.22 Risk cause The UK is currently facing an unprecedented storm of increasing prices, bills and tax. The 40-year high inflation rate of 9% is the main driver of the cost-of- living crisis which has outstripped wage and benefit increases. Risk event Rapid ongoing rise of energy prices as well as food and drink prices. Risk effect The impact on households is already being noted with 87% of adults in the UK reported an increase in their cost of living in April 2022 (Office for National Statistics; Francis-Devine et al, 2022). The price rises will impact low-income households the hardest as a larger proportion of their bills are on energy and food. The Resolution Foundation estimates an extra 1.3 million people will fall into absolute poverty in 2023, including 500,000 children. Chief *Executive; Director *Health and Social Care; Executive Director *Place 1. Council Cost of Living Task Force to oversee the Council’s response to the crisis 2. Allocation of LACER funding to support those most affected 3. Strategic Evaluation Partner appointed to create poverty profile 4. Community Planning Partnership has established a Midlothian Strategic Poverty Prevention Group co-chaired by Council Leader and Director of Public Health 5. New Child Poverty chair and lead appointed (Executive Director Children, Young People and Partnerships) 6. Child Poverty self-evaluation underway with Improvement Service 3 5 Page 115 of 128
Page 116
20 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .22.1 Cost of Living Task Force Q1 23/24: Meetings continuing. Chief *Executive; 31-Mar-2024 100% SRP.RR.21 Cyber Security Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.21 Risk Cause Malicious attempts to damage, disrupt or gain unauthorised access to Council computer systems, networks or devices. Risk Event The cyber threat is severe and advancing quickly.The Council is at significant risk of cyber-attack from Ransomware Phishing Emails, Advanced Persistent Threats (APT) and Distributed Denial of Service Attacks (DDOS) attacks. Hacking and Social Engineering. Risk Effect Access to Council systems by cyber criminals and foreign intelligence agencies for financial, commercial or information gathering reasons. This could lead to significant financial losses, data compromise and subsequent regulatory sanction if our technical and organisational measures are deemed insufficient. Severe business disruption including the almost total loss of critical IT systems and networks leading to significant service delivery challenges. Head of *Adult and Social Care; Cyber Security Information Governance and *Compliance Manager; Head of *Development; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; David Robertson; Chief Officer Young People and Partnerships 1. Implementation of and compliance with the Scottish Government Cyber Resiliency Public Sector Action Plan 2. Cyber Essentials Plus Certification 3. Public Sector Network Certification 4. Regular Audits and Inspections 5. Appropriate technical and organisational measures deployed to reduce the likelihood and impact of an attack 6. Having adequate skills and knowledge in the organisation 7. Implementing Scottish Government Cyber Security Action Plan 8. Adoption of the NCSC (National Cyber Security Centre) Active Cyber Defence programme 9. Technology upgrades 10. Incident Response plans and exercises 3 5 Page 116 of 128
Page 117
21 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .21.1 Appropriate Technical and Organisational Measures Q4 24/25 1. Delivered a week-long cyber security awareness campaign (24 February – 2 March), using email, posters, intranet news, social media, and updates from the Chief Executive 2. Secured a £7,000 grant from the Scottish Government to support cyber security training for Digital Services staff 3. Provided support for the 2025 Audit Scotland audit, focusing on key financial systems and cyber security controls 4. Successfully defended the organisation against multiple cyber attacks 5. Provided security oversight for the onboarding of new applications and technical services Q3 24/25 - Action/mitigation includes: - 1. Quorum cyber security tabletop exercise completed 2. Successfully defended the organisation from several cyber incidents 3. Provided significant Information Governance and Security advice for the continued deployment of M365 and Google Workspace 4. Audit on business continuity 5. Ran successful phishing exercises Q1 24/25 - Action/mitigation includes: - 1. Achieved Cyber Essentials Plus Certification 2. Achieved PSN Certification from the Cabinet Office 3. Organised and facilitated a leadership forum exercise on cyber resilience 4. Successfully responded to 15 significant cyber security events 5. Provided significant Information Governance and Security advice for the continued deployment of M365 and Google Workspace Cyber Security Information Governance and *Compliance Manager; Chief *Digital Officer; 31-Mar-2025 75% SRP.RR.23 Counter Terrorism – Compliance with Legislation Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.2 3 Risk cause Current or new legislation applying to Midlothian Council. Lack of capacity to resource the statutory obligations. Chief Officer Children’s Services, Partnerships 1. There is a CONTEST Lead and Depute (Single Point of Contact (SPOC)) in place. These individuals are also the nominated Prevent SPOC and Depute SPOC. 3 4 Page 117 of 128
Page 118
22 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Risk event Council and/or Services not identifying all applicable actions. The CONTEST and Prevent action plans fall short of what is required Risk effect Council failing to meet its statutory duties, potentially resulting in a negative impact on the safety of employees, service users and visitors to Council facilities. Reputational impact of not meeting statutory duties. and Communities 2. There are designated, trained officers available to Chair Prevent related case conferences (Prevent Multi-Agency Panel). 3. There is a Midlothian CONTEST Group chaired by the Chief Officer Children’s Services, Partnerships and Communities. Membership includes representatives from services in both Council Directorates and the Midlothian Health and Social Care Partnership plus key external partners. Terms of Reference are in place. 4. Executive Directors, Chief Officers and Heads of Service are responsible for ensuring that their services comply with allocated actions and identifying any concerns and additional actins required. 5. An annual report on CONTEST activities is submitted to the Corporate Management Team. 6. Prevent assurance Statements are required by the Home Office and Scottish Government every two years. 7. Relevant information and updates received from external partners and organisations are disseminated to CONTEST Group members and others as appropriate. 8. E-learning CONTEST related modules, including Prevent products are Mandatory. In-person and written briefings are available to other staff groups who do not have access to e- learning or for whom the full briefing is not appropriate. Risk Code Related Action Related action latest note Managed By Due Date Status SRP.RA.23. 01 Review and implement the recommendations from the Prevent Assurance 2025 process. Q4 24/25: The Home Office is due to provide feedback on the Midlothian Council Prevent Assurance 2025 submission. Communication during the process indicated that guidance would be given in respect of at least one of the assessment areas. Chief Officer Children’s Services, Partnerships and Communities June 2026 0% SRP.RA.23. 02 Terrorism (Protection of Premises) Act 2025: Implement the requirements of the Act as they become clear through Government guidance. Q4 24/25: New legislation. The Terrorism (Protection of Premises) Act 2025 (also known as Martyn’s law) received Royal Assent on Thursday 3 April. The Government intends for there to be an implementation period of at least 24 months before the Act comes into force. This period will enable those responsible for premises and events to have sufficient time to understand their new obligations, and to plan and prepare accordingly. Whilst those that fall within scope of the Act may wish to consider the requirements, there is no requirement to comply with them until the legislation comes into force. The Home Office will publish statutory guidance during the 24-month implementation period. Chief Officer Children’s Services, Partnerships and Communities 2027 0% Page 118 of 128
Page 119
23 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 SRP.RR.04 Employee performance Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.04 Risk cause Employees not suitably trained/developed for the roles required of them. Limited availability of qualified practitioners in certain sectors. Change program not informed by all key stakeholders. Ageing work force. Employees unclear on expected behaviours. Employees constrained to innovate as a result of management practice. Employee productivity rate below the required level because of ineffective use of the People Policies particularly Maximising Attendance. Salaries in some functional areas lower compared to other LA’s resulting in recruitment issues particularly with trying to recruit experienced staff. Risk event Employees not engaged/consulted as part of organisational transformation. Experienced employees leaving the organisation. Inability to recruit suitably qualified / trained staff to fill vacancies negatively impacting on remaining workforce. Unacceptable behaviours demonstrated by employees. Stated organisational culture not consistently reinforced by managers. Poor employee performance will stifle transformational change. Risk effect Difficulties recruiting the right staff. Challenges retaining quality staff. Low skill levels. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; HR Strategic Lead; Chief Officer Young People and Partnerships Over-riding risk control measure = Focus on having the right people, here, healthy, performing, behaving and well led via effective utilisation of the workforce strategy and accompanying action plan. Approval of the Council’s Workforce Strategy 2024-2034 which focuses on the thematic areas below: Attendance / Wellbeing 1. Continuing implementation of the Wellness@Midlothian agenda. 2. Creation of an Employee Health and Wellbeing Strategy and supporting policy. 3. Maintaining the Healthy Working Lives Gold Award. 4. Proactive use of Occupational Health, Midlothian Physiotherapy, Employee Assistance Programme and the Workplace Chaplaincy Service. 5. Change of EAP supplier to ensure provision of best possible service. 6. Development of progressive People Policies. 7. Roll-out of mental health training for staff and managers. Performance 1. Service-level workforce plans. 2. Structured, robust, well established ‘Making Performance Matter’ Framework where expected standards of behaviour and Council values are re-enforced. 3. Continued re-enforcement of all People Policies involving various communication methods. 4. Development of a suite of management information to ensure Service Managers are informed e.g., turnover, absence levels/reasons etc. Organisational Change 1. Policy for Organisational Change includes strong emphasis on early engagement of employees. 2. Redeployment Procedure to ensure maximum chance of successful redeployment. Conduct 1. Resolution Policy encourages early intervention of workplace issues. 2. Professional standards and values build into the induction process and management development programme. 3 4 Page 119 of 128
Page 120
24 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Low morale, especially during change. High absence rates, loss of experience in service areas. ‘A Great Place to Grow’ our values including respect, collaboration, pride and ownership not realised, potentially resulting in missing the opportunity to capitalise on the abilities, experience and ideas of team members. Poor employee performance will Exacerbate the financial challenge. Communication 1. A range of initiatives to keep staff informed of change (Chief Executive’s weekly email, Connect, All staff emails, tailored team briefings etc. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .02.04 Development and Delivery of the Council’s Workforce Strategy 2024-34 including analysis of future workforce requirements, gap analysis and gap closing strategies, and performance measures and target setting. Q1 25/26: Q1 25/26: Workforce Planning workshops completed with HR/OD team. Next session with CMT scheduled in September then onwards to Council Senior and Service Managers for full rollout. Q4 24/25: Council approved the Workforce Strategy 2024-2034 in December 2024. Work progressing on the delivery of the first three years through an agreed action plan. Acting HR Strategic Lead appointed. Two interim posts from BTB funding are being progressed for Talent and Reward. Q1 24/25: Workforce Strategy in development and expected to be presented to December Council with Action Plan for approval. Audit Scotland external audit on workforce and digital to be presented to Audit Committee September 2024. Chief Officer Corporate Solutions 31 Dec 2027 25% NEW Recruitment challenges in Procurement Service leading to contract management pressures and backlog in procurement exercises Q1 25/26: Procurement Manager in place. Additional Procurement Assistant resource (fixed term) onboarded August 2025. Category management realignment agreed and handover in progress. Business partnering model to commence in September 2025. Contract management framework drafted and in review. Contract register updated quarterly and published online. Pipeline in development for each category. Q4 24/25: Procurement Manager appointed to start on 1 June 2025. Chief Officer Corporate Solutions to implement an improvement plan and revised work plan for the service and develop business case for appropriate resourcing. Chief Officer Corporate Solutions 31 Dec 2025 10% Page 120 of 128
Page 121
25 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 SRP.RR.07 Care at Home Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.07 Risk cause Internal and External providers of Care at Home services unable to meet service and quality requirements as a result of a lack of capacity. Risk event Capacity of Community Support outstripped by demand. Risk effect There is a risk that patients will have their discharge delayed because there is insufficient community supports to enable timely discharge leading to deterioration in their health, beds being blocked and elective operations being cancelled. Head of *Adult and Social Care; Director *Health and Social Care 1. Care at Home winter assurance plan and business continuity plan complete 2. Development of Care at Home Service Improvement action plan near completion 3. External commissioning complete and ongoing contract monitoring in place 4. External provider audits complete 5. Re-established Multi-Agency Quality in Care at Home quarterly review meetings jointly with East Lothian 6. Weekly provider meetings in place 7. Additional locum team members and contracts with agency staff in place 8. Daily discharge meeting with Multidisciplinary and Multi-agency team planning to plan and coordinate discharge to ensure care at hone support in place 3 4 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .07.01 Independent review of adult and social care Q3 24/25: Scottish Government announced in January 2025 that they will not be proceeding with the National Care Service. Q2 24/25: The Scottish Government has initiated a pause on the development of the NCS. Head of *Adult and Social Care; Chief *Executive; 31-Jan-2024 100% SRP.RR.10 Governance and Standards in Public Life Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.10 Risk cause Code of conduct for Members and employees’ actions falling short of International Standards. Legal *and Governance Manager; Chief *Executive; Chief Officer *Place; 01 Annual Assurance Statement. 02 Standing Orders 03 Scheme of Administration 04 Scheme of Delegation 05 Elected Member Code of Conduct 2 4 Page 121 of 128
Page 122
26 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Risk event Failure in openness, accountability, clarity. Risk effect Service, partnerships and project outcomes not achieved. Non- compliance with conduct standards and reduction in standards in public life. Executive Director *Place; Chief Officer Corporate Solutions 06 Induction programme for new members and ongoing learning and development programme 07 Employee Code of Conduct Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .03.05 Review of Standing Orders, Scheme of Administration and Scheme of Delegation Q4 24/25: Standing Orders and Scheme of Administration updated and approved at Feb 2025 Council. Q1 24/25: Workplan presented and agreed by SOWG in April 2024. Some changes to SOs and Scheme of Administration presented and approved by Council in May 2024. Legal *and Governance Manager; Chief Officer Corporate Solutions; 28 Feb 2027 20% SRP.RA .10.03 Review of the employee onboarding and induction programme Q1 25/26: Content for online induction now finalised – in design phase prior to launch in Autumn. Next step is face to face induction programme. Q4 24/25: Work ongoing to finalise the refreshed induction programme and onboarding process Chief Officer Corporate Solutions 31-Dec-2025 5% SRP.RR.12 Internal Control Environment Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.12 Risk cause Work procedures/process inadvertently create the capacity for fraud and waste to occur. Internal Controls requiring more time, effort or cost than the risk being managed. Mangers failing to follow procedures and keep systems updated with accurate information. Risk event Persons exploiting opportunities to commit fraud. Waste and errors Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief 1. Services have been prompted to consider fraud and waste within Service Risk Registers. 2. Risk Management Guide provides direction on the need to balance time, effort and cost against benefit of risk controls. 3. Internal Audit examine internal control arrangements based largely on the risk registers. 4. Corporate Fraud team in place who assist managers to undertake fraud risk assessments in their areas (focused on priority areas) and provide advice and guidance on fraud related matters. Active participation in the National Fraud Initiative to investigate matches. 5. Whistleblowing Policy and Counter Fraud Policy in place (subject to review) with whistleblowing channels available to report concerns (anonymously if required). 2 3 Page 122 of 128
Page 123
27 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Changing risk landscape associated with remote working solutions. Risk effect Waste and loss Risks over managed with risk controls costing more than the potential loss being managed. Increased opportunity for fraud or financial loss has direct impact on management information. Has adverse effect on service performance. Finance Officer; Chief Officer Young People and Partnerships 6. Internal and external assurance. Annual Governance Statement which involves obtaining assurance from Management over controls in their Service. 7. E-learning for staff to complete mandatory training for fraud awareness. 8. Regular updates to Audit committee on progress with recommendations made by Internal Audit. 9. Remind staff to declare secondary employment/outside interests and gifts & hospitality 10. Induction for all new employees (with service exceptions), including legal, HR, procurement, health and safety. Control at entry to organisation. 11. The Integrity Group continues to meet to improve the Council’s resilience to fraud, corruption, theft and crime (including cybercrime), maintaining proper risk management, governance and internal control processes and systems to ensure probity in systems and operations, and mitigation of risks, including the prevention, detection and resolution of fraud and irregularities. Management is also responsible for checking that the arrangements and controls are operating effectively and obtaining assurances from internal compliance, risk, inspection, quality, and control functions. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .12.04 Review of Serious Organised Crime (SOC) group Q3 24/25: Draft Strategy devised. Regulatory safeguards/actions progressing through Licensing. Q1 24/25: Initial meeting with Police is planned to discuss strategy. Chief Officer *Place; Health, Safety & Resilience Manager 31-Mar-2025 50% SRP.RR.11 Corporate Policies and Strategies Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.11 Risk cause Policies may not match the aspirations of the Council's Strategic priorities or cultural perspective. Risk event Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; 1. Single Midlothian Plan providing overarching direction 2. Service plans aligned to Single Midlothian Plan. 3. Leadership team to ensure correct approaches are adopted to get the right results. 4. Strategic housing investment plan, submitted to Scottish Government. 5. Capital Strategy 6. Integrated Joint Board (IJB) Plan 2 3 Page 123 of 128
Page 124
28 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Policies not monitored may become out of date. Policies not reviewed to ensure alignment with strategic priorities. Risk effect Policies not monitored could result in non-compliance with legislation Policies not aligned to strategic priorities will inhibit rather than support implementation of strategic priorities. Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 7. IJB Strategic needs assessment 8. Midlothian Local Development Plan 2017 – the Council’s corporate spatial strategy. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .02.04 Transformation Blueprint 2023 to 2028 Q1 25/26: Refer to SRP.RA-02.08 Q4 24/25: Refer to SRP.RA-02.08 Q3 24/25: Refer to SRP.RA-02.08 Q2 24/25: Refer to SRP.RA-02.08 Q1 24/25: Work on sprints continues with some reporting to BTSG in the run up to June Council with the majority of others scheduled for August. BTB is now meeting fortnightly to encourage and closely monitor progress. To support monitoring of progress a dashboard has been developed and this is shared with CMT and BTSG as a standing item. Chief *Executive; Chief Finance Officer; 30-Jun-2028 20% SRP.RA .03.07 Review of policy and creation of a policy register Q1 25/26: See comments earlier in SRP. Q4 24/25: Policy list presented to CMT May 2025 for CMT to review and feedback Chief Officer Corporate Solutions 31-Dec-2025 10% SRP.RA .11.05 Antisocial Behaviour Policy Q1 24/25: Member Briefing on Housing and Antisocial Behaviour to be prepared and presented during Q2, with report to Council to follow. Chief Officer *Place; 31-Dec-2024 0% Page 124 of 128
Page 125
29 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Strategic Opportunities SRP.OP.08 Capital Projects - Housing Risk Code Risk Identification Managed by Risk Commentary Risk Evaluation SRP.O P.08 Cost of delivering Affordable Housing Supply Programme has risen at faster rate than available grant to Midlothian and continued high build costs will affect ability to deliver housing programme. Policy requirement to deliver 25% affordable on new housing sites under significant pressure due to grant level not growing with housebuilding rate. More sites will be unable to delivery subsidised homes for rent due to shortfall in grant. Projects progressing, with Timeline, Budget, Risk and Resource categorised as parameters on a RAG status, with any Red classifications identified and reported. Executive Director *Place; Head of Development 1. Edmonstone Road, Shawfair – Timeline, Budget and Risk impacted with Stewart Milne entering administration. However, site now amber due to appointment of Dundas Building to finish site. Now on site. 2. Newtongrange Former Pool & Church Hall sites. Requirement to deliver 3D modular units on site. V limited Scottish suppliers for 3D due to Connect going into administration. VfM to be examined in tender report in Q2. Phase 5 housing programme has been reviewed to ensure affordability within the Housing Revenue Account. Grant level now restored to 2023/24 level with core RPA £10.534m and additional grant uplift from £40m of £1.062m, which is to be used for acquisitions to address temporary accommodation pressures. However, high level of housing delivery and restored grant insufficient to support all housing sites to deliver subsidised 25% affordable homes. Timeline Budget Risk Resource A A A G A A A G SRP.OP.09 Capital Projects – Transport, Net Zero & Infrastructure Risk Code Risk Identification Managed by Risk Commentary Risk Evaluation SRP.O P.09 Cost of delivering enabling infrastructure projects has risen, resulting in significant funding gap emerging. Expansion of scope by Transport Scotland and restrictions on timing of ecology surveys driving further cost and timing risks. Projects progressing, with Timeline, Budget, Risk and Resource categorised as parameters on a RAG status, with any Red classifications identified and reported. Executive Director *Place; Head of Development 1. A701 Relief Road 2. A701 Sustainable Trasport Corridor 3. A701 Straiton Junction Improvements For all highlighted projects, estimated cost significantly exceeds budget available to deliver project. For all highlighted projects, addressing requirement for investment in A701 corridor in phases with prioritisation applied. Bush Loan Junction progressing ahead of remaining programme fully funded by ESESCRD funding. Timeline Budget Risk Resource R R R G R R R G R R R G Page 125 of 128
Page 126
30 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 SRP.OP.10 Capital Projects – Children, Young People & Partnerships Estates Programme: Primary Risk Code Risk Identification Managed by Risk Commentary Risk Evaluation SRP.O P.10 Projects progressing, with Timeline, Budget, Risk and Resource categorised as parameters on a RAG status, with any Red classifications identified and reported. Executive Director *Place; Executive Director CYPP; Head of Development 1. Mayfield/St Lukes PS New Build: Cost reduction exercise complete,Contract signed, Site start on 30th June 2025, with school expected to open February 2027. 2. Mauricewood PS Extension & Refurbishment: Rising roll and catchment review requires investment in school to address capacity and suitability. Limited budget available. Funding insufficient as some contributions were withdrawn for pay for costs of previous extension. Paper to CPAMB to seek approval to provide 6 classrooms and a gym hall, developer contribution funded. 3. Bilston PS Extension: Rising roll and catchment review requires investment in school to address capacity and suitability. Limited budget available. Design team appointed to develop investment in school that aligns with budget available from Developer Contributions. Design is currently being market tested to ensure project stays within the budget envelope, developer contribution funded, Construction anticipated to start Jan 2026 4. Relocation of Mount Esk Nursery / Hawthorden Extension: Rising roll and catchment review requires investment in school to address capacity and suitability. Limited budget available. Design team appointed to develop investment in school that aligns with budget available from Developer Contributions. Stage 2 design and costs complete. Work ongoing Budget Risk Resource A R A A A R R A A A A A A A A A SRP.OP.09 Capital Projects – Children, Young People & Partnerships Estates Programme: Secondary Risk Code Risk Identification Managed by Risk Commentary Risk Evaluation SRP.O P.09 Projects progressing, with Timeline, Budget, Risk and Resource categorised as parameters on a RAG status, with any Red classifications identified and reported. Executive Director *Place; Executive Director CYPP; Head of Development 1. Beeslack HS Replacement: Site acquisition being progressed. Planning consent now in place. Preferred contractor appointed under two stage process. Cost reduction work due to start next 2. Shawfair All Through: Site acquisition complete. School location fixed with design team. Remediation programme underway by Shawfair LLP. Shawfair All Thorugh Campus budget approved at Council. Project team appointments to forthcoming project board 3. Penicuik HS New Build: LEIP target for delivery is Dec 2026, however programme for occupation is July 2027. Cost reports tracking higher and risks identified in refurbishment works. SFT Timeline Budget Risk Resource R A A G R A A A A A A G Page 126 of 128
Page 127
31 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 advising if additional LEIP funding available to address abnormal costs. Contractor, Morrison Construction appointed Jan’25. Decant works complete, advance works being planned SRP.OP.09 Capital Projects – Regeneration Risk Code Risk Identification Managed by Risk Commentary Risk Evaluation SRP.O P.10 Projects progressing, with Timeline, Budget, Risk and Resource categorised as parameters on a RAG status, with any Red classifications identified and reported. Executive Director *Place; Head of Development 1. Vogrie Changing Places: issues with contractor overcame. Part of wider Vogrie Renewal Strategy. 2. Destination Hillend: Alpine Coaster delivered with access and parking infrastructure and Coaster now open. Project absorbed risk and contingency. Updated brief issued to SSM for high level site planning and to brief Members in Q2. 3. Hopefield Industrial Estate: Updated financial model required. Cost plan for upgrade to infrastructure being developed 4. Dalkeith Asset Rationalisation Programme: Decant of staff to Fairfield House complete underway and planning application for works to Midlothian House submitted . Contractor appointed however project now overbudget and being rescoped. Timeline Budget Risk Resource R A R A R R R A R A A G A R A G SRP.OP.04 City Deal Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.O P.04 South East Scotland Region City Deal - a bid for funding to Scottish and UK Governments to accelerate economic growth through investment in infrastructure/ housing/ skills and innovation. 200 Council Houses linked to the City Deal. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer 1. Maintain strong Midlothian involvement through the City Deal governance structure. 2. Midlothian City Deal Key Officer (Internal) Group. 3. Securing best arrangements for Midlothian through close liaison with partners and conclusion of business cases. 4 5 Page 127 of 128
Page 128
32 STRATEGIC RISK PROFILE, Q1 Apr-Jun 2025 Young People and Partnerships Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.O P.04.02 Realisation of outcomes of respective workstreams Q1 24/25: Work continues on the relevant programmes. Executive Director *Place 31-Mar-2025 10% Page 128 of 128