|
Subject:
|
Strategic Risk Focus
Report: SR36, SR23 and SR21
|
|
Date of Meeting:
|
28th
September 2021
|
|
Report of:
|
Executive Lead
Officer, Strategy, Governance & Law
|
|
Contact Officer:
|
Name:
|
Kat Brett
|
Tel:
|
01273 293846
|
|
|
Email:
|
Kat.Brett@brighton-hove.gov.uk
|
|
Ward(s)
affected:
|
All
|
FOR GENERAL
RELEASE
1. PURPOSE OF
REPORT AND POLICY CONTEXT
1.1
To report to the Audit & Standards Committee on the latest
quarterly update to the city council’s Strategic Risk
Register (SRR).
1.2
The Committee have agreed to focus on at least two strategic risks
(SRs) at each of their meetings. For this meeting there are three
SRs risks to receive focus and to enable Members’ questions
to be asked there will be attendance by Risk Owners as detailed
below:
The Executive
Director, Economy, Environment & Culture (ED EEC) in respect
of:
SR36 Not
taking all actions required to address climate and ecological
change and transitioning our city to carbon neutral by 2030.
SR23 Unable
to develop and deliver an effective Regeneration and Investment
Strategy for the seafront and ensure effective maintenance of the
seafront infrastructure.
The Executive
Director, Housing, Neighbourhoods & Communities (ED HNC) in
respect of:
SR21 Unable to manage housing pressures and deliver new
housing supply.
2.
RECOMMENDATIONS:
That the Audit & Standards Committee:
2.1
Note the SRR detailed within Table 1 of
this report.
2.2
Note Appendix 1 the CAMMS Risk
report with details of the three SRs and actions taken
(‘Existing Controls’) and actions planned.
2.3
Note Appendix 2 which provides:
i.
a guide on the risk management process;
ii.
guidance on how Members might want to ask questions of Risk Owners,
or officers connected to the strategic risks; and
iii.
details of opportunities for Members, or officers, to input on
Strategic Risks at various points and levels.
2.4
Make recommendations for further action(s) to the relevant council
body.
3.
CONTEXT/ BACKGROUND INFORMATION
3.1
The city council’s SRs are reviewed quarterly by the
Executive Leadership Team (ELT) taking on board comments from
quarterly risk reviews carried out at Directorate Management Teams.
This process ensures the currency of the city council’s
SRR.
3.2
The Audit & Standards Committee has a role to monitor and form
an opinion on the effectiveness of risk management and internal
control.
3.3
The initial risk score takes account of the existing controls in
place to mitigate the risk (current score). The revised risk score
assumes that all risk actions are successfully delivered (target
score). The ‘likelihood’ score ranges from Almost
Impossible (1) to Almost Certain (5) and the ‘impact’
score ranges from Insignificant (1) to Catastrophic (5). These
scores are multiplied to give the risk score.
3.4 At ELT’s review of
the SRR on 14 July 2021 no risks were removed, no new risks were
proposed or agreed. There remain 16 Strategic Risks. There were no
changes to the Strategic Risk Register.
The risk heat map
and Table 1, below, shows the current 16 Strategic Risks in the
highest Revised Risk order which takes account of future actions to
reduce or mitigate the risks.
4.
ANALYSIS & CONSIDERATION OF ANY ALTERNATIVE OPTIONS
4.1
Through consultation with ELT the Risk Management process currently
in operation was deemed to be the most suitable model.
5.
COMMUNITY ENGAGEMENT & CONSULTATION
5.1
This is an internal risk reporting process and as such no
engagement or consultation has been undertaken in this regard.
6.
CONCLUSION
6.1
The council must ensure that it manages its risks and meets it
responsibilities and deliver its Corporate Plan, risk management is
evidence for good governance.
7. FINANCIAL &
OTHER IMPLICATIONS:
Financial
Implications:
7.1
For each Strategic Risk there is detail of the actions already in
place (‘Existing Controls’) or work to be done as part
of business or project plans (‘Risk Actions’) to
address the strategic risk. Potentially there may have significant
financial implications for the authority either directly or
indirectly. The associated financial risks are considered during
the Targeted Budget Management process and the development of the
Medium Term Financial Strategy
Finance Officer Consulted: Jeff
Coates
Date: 17/08/2021
Legal
Implications:
7.2
All Strategic Risks which are reported to the Audit & Standards
Committee may potentially have legal implications. Members are
referred to Appendix 1 of this Report for the detailed description
(a description which normally makes reference to any legal
implications of a direct nature) provided of the Strategic Risks
being focused on in this Committee cycle.
7.3
The Council has delegated to its Audit & Standards Committee
its powers and duties in relation to risk management, and as a
result, this is the correct body for considering this Report.
Lawyer Consulted: Victoria
Simpson
Date:19/08/2021
Equalities Implications:
7.4
Risk owners are requested to ensure that equalities implications
are considered in describing strategic risks, their potential
consequences and when developing mitigating actions. This will be
part of regular ELT & DMT risk review sessions.
Sustainability Implications:
7.5 SR36 has a key focus on
sustainability. There are additional strategic risks, such as SR23
and SR21, which have sustainability implications. Risk owners will
be requested to continue considering sustainability implications
and this will also be part of regular ELT & DMT risk review
sessions.
Any Other
Significant Implications:
7.6
None.
SUPPORTING DOCUMENTATION
Appendices:
1.
Appendix 1: CAMMS Risk report SR36, SR23 and SR21.
2.
Appendix 2: A guide on the risk management process and how Members
might want to ask questions of Risk Owners in relation to Strategic
Risks.
Background Documents
1. None.
APPENDIX
2: A guide on the risk management process
including the questions Members might want to
ask of Risk Owners in relation to Strategic Risks
1. Across the
council there are a number of risk registers which prioritise
risks consistently by assigning risk scores 1-5 to the
likelihood (denoted by ‘L’) of the risk occurring, and
the potential impact (denoted by ‘I’) if it should
occur. These L and I scores are multiplied; the higher the result
of L x I, the greater the risk.
e.g. L4xI4 which denotes a
Likelihood score of 4 (Likely) x Impact score of 4 (Major), which
gives a total risk score of 16.
2. A colour coded
system, similar to the traffic light system, is used to distinguish
risks that require intervention. Red risks are the highest,
followed by Amber risks and then Yellow, and then Green.
3. The Strategic
Risk Register (SRR) mostly includes Red and Amber risks. Each
strategic risk has a unique identifying number and is prefixed by
‘SR’ representing that it is a strategic risk.
4. Each risk is
scored twice with an Initial ‘Current’ level of risk
and a Revised ‘Target’ risk score:
a) The
Initial ‘Current’ Risk Score reflects the
Existing Controls already in place under the ‘Three Lines of
Defence’ methodology. This represents good practice as it
identifies the First Line – Management Controls; Second Line
– Corporate Oversight; and Third Line – Independent
Assurance and the currency and value of each control in managing
the risk. Therefore the Initial Risk Score represents the ‘as
is’/ ‘now’ position for the risk, taking account
of existing controls.
b) The
Revised ‘Target’ Risk Score focuses on the
application of time and expenditure to further reduce the
likelihood or impact of each risk. It assumes that any future Risk
Actions, as detailed in risk registers, will have been delivered to
timescale and will have the desired impact.
c) The Risk
Owners are asked to consider the 4Ts of Risk Treatments –
Treat, Tolerate, Terminate, Transfer. Risk actions should reduce
the likelihood and/or impact – if neither are true, there
will not be any reason to undertake the action.
Suggested questions
for Members to ask Risk Owners and officers on Strategic Risks
The Audit & Standards Committee has a role
to monitor and form an opinion on the effectiveness of risk
management and internal control. As part of discharging this role,
the Committee focuses on at least two Strategic Risks at each of
their meetings.
The Committee invite the Risk Owners of
Strategic Risks to attend Committee and answer their questions
based on a CAMMS Risk report appended to each Report. In the
CAMMS Risk report, the Risk Owner:
1. Describes
the risks, the cause and potential consequences and the officers
involved and provides an Initial ‘Current’ Risk
Score which takes account of the existing controls in place to
mitigate the risk.
2. Existing
Controls are set out using the Three Lines of Defence model:
·
1st line: management controls
·
2nd line: corporate oversight
·
3rd line: independent assurance
This is provided in order
that Members can identify where the assurance comes from, and how
frequently it is reviewed and in the case of the 3rd
line, then whether audits of inspections have happened and if so
when that did it happen and what the results were. Risk Owners
ensure that existing controls continue to operate effectively.
3. (Future)
Risk Actions then are detailed and allocated to individuals with
percentages achieved against target dates, with commentary on the
current position. This provides the Revised ‘Target’
Risk Score which assumes that all the risk actions have been
successfully delivered.
The Risk Owners of Strategic Risks will always
be an Executive Leadership Team (ELT) officer. They may bring with
them to Committee other officers who are more closely connected to
the mitigating work.
Three areas of enquiry are suggested to be
explored by the A&S Committee:
1. Is the
Risk Description appropriately defined? Does the Committee
understand the cause and potential consequences?
2. Is the
Committee reassured that each (future) Risk Action either reduces
the impact or the likelihood of the risk? Are members reassured
that risk actions are actually being delivered?
3. In respect
of the Initial ‘Current’ and Revised
‘Target’ Risk Scores, does the Committee feel
comfortable with Risk Owner’s assessment? This represents the
risk level that the organisation is prepared to accept.
How Members and
officers can input on Strategic Risks (SRs)
The risk management process benefits from
input by Council Members and by staff at all levels. The
opportunities to do this are:
Members to ELT leads:
·
Each SR is discussed between Members and ELT leads at the regular
meetings with Committee Chairs
·
Members are responsible for raising risks that they identify with
their contact officers, often the Head of Service, Assistant
Director or Executive Director
·
Any risk suggestion from Members will be reviewed by ELT and any
actions taken will be reported back to the relevant Member(s).
Officers to Line Manager, Directorate
Management Team (DMT) or corporate risk management lead:
·
The Behaviour Framework expects all officers to escalate risks
and/or or suggest mitigations to their line managers. If
officers feel they do not have appropriate access to their line
managers, they may escalate the risk to the corporate risk
management lead
·
Risks may get discussed as part of staff meetings, PDPs/121s/ team
and service meetings or part of projects or programmes. Any
significant risks to be escalated through to their Head of Service/
Assistant Director to raise through the management chain and
discuss at quarterly DMT risk reviews.
·
The ELT lead within a directorate will discuss escalated risks with
the DMT at least on a fortnightly basis and will seek assistance as
required. They have access to ELT and determine the way forward in
consultation with the Risk Management Lead.
DMT to ELT:
·
The quarterly SR review at ELT includes a summary of Directorate
Risks reviewed at DMTs
·
The ELT lead within a directorate will discuss escalated risks with
the ELT and determine the way forward i.e. whether to amend the
Strategic Risk Register
