Agenda item: 8
Committee: Audit & Standards Committee
Date of meeting: 19th September 2011
Subject: Risk Management Strategy
Lead Officer: Head of Finance
Portfolio Holder: Resources - Councillor T Oliver
Link to Council Priorities: All
Exempt information: None
Delegated status: For Recommendation to Council on 12th October 2011
EXECUTIVE SUMMARY:
The Council’s current Risk Management Strategy was considered by the Audit & Standards Committee on 17th November 2010 and approved by Council on 8th December 2010
RECOMMENDATION: THAT
MEMBERS CONSIDER THE RISK STRATEGY AND RECOMMEND APPROVAL TO COUNCIL.
REPORT:
1. As Members will be aware, the Council’s Risk Management Strategy forms an important link in the successful delivery of the Council’s Vision and Objectives.
2. The Strategy sets out the Council’s approach to the management of risks that may be encountered in delivering high quality Services.
3. Risk Management is a continuous and advancing process, and a thorough review of the Strategy was considered by this Committee at its meeting on 17th November 2010.
4. Officers have reviewed the Strategy approved by the Council on 8th December 2010 and do not consider that any changes are required for 2011 except for the removal of the reference to the Council’s VFM programme which has been completed.
5 The Audit & Standards Committee has an important role to play in monitoring the
effective development of Risk Management and Members are requested to consider and approve the Strategy, attached at Appendix “A”.
6. As part of the budget setting process the Council will review it’s Corporate Strategic Risk Register and amend the scores to reflect risks facing the Authority. The 2012 /13
Strategic Risk Register is currently under review prior to submission to Cabinet in February 2012
7. The Audit and Standards Committee is asked to review the Corporate/Strategic Risk Register and forward any comments it may have to Council.
8 Risk Management developments
A series of risk management initiatives are currently being considered and developed with a view to enhancing and progressing current procedures and practices involving:
• Improving efficiency in risk reviews and documentation processes
• Compliance with British Standards in accordance with best risk management practices
• Minimising spend through appropriate application and monitoring of risk control measures
The table below is an extract from our project management programme which details priorities and inception and completion dates for these developments.
Item Added Value
Define classifications for
risk impact and probability − Allows for consistency across departments Classifications have been defined and approved by the Corporate Risk Management Group and will be incorporated in to the new Risk Management database (please see below).
Re evaluate review periods − Enforces controls on high impact risks
− Reduces potential for unidentified, escalating risks Amended review periods have been referred to the Corporate Risk Management Group and will be incorporated in to the new Risk Management database (please see below).
Add partnerships risks where the overall consequence to the Council would be measured as 3 or more using the risk impact criteria to risk registers
− Allows for all risks to be recorded and monitored on central database
− Uniformity in management of partnership and other risks
Significant partnership based risks are to be added to risk registers in accordance with best practice. Add vehicle based risks
where the overall consequence to the Council would be measured as 3 or more using the risk impact criteria to risk registers
− Allows for all risks to be recorded and monitored on central database
− Uniformity in management of partnership and other risks
− Complies with recommendations of Fleet Risk management report commissioned by Insurers Significant vehicle based risks are to be added to risk registers in accordance with insurance
Risk Management
database − Provides a Performance Management tool to Heads of Departments and Risk Owners measuring risk tolerance against risk scores − Provides for periods of reviews based on risk
impact scores
− Incorporates all strategic and operational Risk registers within one central database
− Allows for Risks to be recorded and reviewed − Assessments, Controls and Projects may be
recorded, reviewed and linked to Risks. − Overdue reviews may be identified.
Negotiations with Covalent, the suppliers of the Council’s Performance Management database, are underway with a view to extending the database facilities to include Risk Management.
Reinstatement of Business Continuity Management programme / Business Continuity Working group
− Enables compliance with BS 25999 and Civil Contingency Act 2004
− Develops Council’s resilience to high impact risks
− Demonstrates risk management in accordance
with best practice
− Maintains a current contact list for the Business Continuity Team
− Maintains an accessible framework for Business Continuity Management which is subject to ongoing reviews
The Business Continuity Working Group has now been reinstated and an updated draft Elmbridge Borough Council Business Continuity Plan and Integrated Emergency Management Strategy have been produced.
Risk Management / Business Continuity Management / Contract Management toolkits
− Accessible point of reference available to all EBC employees providing guidance on
· Risk management policies and procedures · Accountability
· Reporting structures · Insurance
Risk Management and Contract Management toolkits have been produced and referred to Corporate
Management Board.
9 Specific, ongoing Risk Management projects include Information Governance dealing with access to the Council’s IT network, reporting of security breaches and compliance with the Code of Conduct (CoCo) requirements
Financial Implications:
None for the purpose of this report.
Environmental/Sustainability Implications: None for the purpose of this report.
Legal Implications:
None for the purpose of this report. Equality Implications:
None for the purpose of this report. Risk Implications:
It is important to ensure that the Council has a framework in place for identifying and controlling risks to the achievement of its Strategic Objectives.
Community Safety Implications: None for the purpose of this report. Principal Consultees:
None.
Background Papers: With the Head of Finance. Enclosures/Appendices:
Appendix “A”: Risk Management Strategy. CONTACT DETAILS
Head of Finance – 01372 474123 [email protected] Risk Manager – 01372 474142 [email protected]
ELMBRIDGE BOROUGH COUNCIL RISK MANAGEMENT STRATEGY Purpose, Aims and Objectives
1. The Council is responsible for delivering a wide range of services and the purpose of this Strategy is to effectively manage potential opportunities and threats to the Council achieving its objectives.
2. This Risk Management Strategy has the following aims and objectives: • Integration of Risk Management into the culture of the Council.
• Raising awareness of the need for Risk Management by all those connected with the delivery of services (including Partners, Delivery Agents etc).
• Enabling the Council to anticipate and respond to changing social, environmental and legislative conditions.
• Minimisation of injury, damage, loss and inconvenience to residents, staff, service users, assets etc; arising from or connected with the delivery of Council services.
• Introduction of a robust framework and procedures for identification, analysis, assessment and management of risk, and the reporting and recording of events, based on best practice.
• Minimisation of the cost of risk.
3. To achieve these aims and objectives, the following strategy has been adopted; • Maintain clear accountabilities, roles and reporting lines across all Council
services.
• Acquire and develop the necessary skills and expertise.
• Provide for risk assessment in all decision making processes of the Council. • Develop a resource allocation framework for Risk Management.
• Ensure appropriate consideration of risk within all Council decisions, reviews of service performance and subsequent improvement plans.
• Develop toolkits, procedures and guidelines for use across the Council.
• Develop arrangements to measure performance of Risk Management
activities against the aims and objectives.
• To make all Partners, Providers and Delivery Agents aware of the Council’s expectations on risk, both generally as set out in its Risk Management Policy, and where necessary in particular areas of service delivery.
Accountabilities, Roles and Reporting Lines
4. A framework has been implemented that addresses the following issues: • The different types of risk – Strategic and Operational.
• Where they should be managed.
• Corporate, Directorate and Divisional roles and accountabilities. • The need for a “driving force” within the Council.
5. In most cases, Risk Management follows existing Service Management
arrangements – certainly Operational Risk is best managed in this way i.e. by the very people who manage service delivery. Strategic Risk is best managed at Corporate Management Board level.
6. However, to enhance the linkages between the two, the Council has also established a Corporate Risk Management Group, that is accountable to the Corporate Management Board and is the “driving force” behind developing and implementing the Risk Management Strategy. The Group is led by the Head of Finance includes Legal, Risk Management, Audit and Health & Safety /
Emergency Planning support and front line services, together with other appropriate Officers.
Framework for Risk Management Reporting Lines 7.
Group Role
Cabinet
(Reporting Annually)
Monitoring of Risk Management Strategy and Corporate/Strategic Risk Register Audit & Standards Committee
(Reporting Six Monthly)
Review of Risk Management Strategy and monitor development of Risk Management
Corporate Management Board (Reporting Quarterly)
To ensure the Council manages risk effectively through the Risk Management Strategy and considers Strategic Risks affecting the Council. To give advice to Cabinet regarding Risk Management compliance.
Corporate Risk Management Group
(Reporting Quarterly)
Develop Risk Management Strategy and supporting framework. Monitor and review Strategic Risk Register.
Directorate Management Teams (Reporting Quarterly)
Implement Strategy and monitor Service Operational Risk Registers, reporting on progress and emerging issues
Heads of Service
(Reporting Monthly (where appropriate) to Officers with risk management responsibilities)
Manage risk effectively in their service area, reporting on how hazards and risks are managed and preparing Operational Risk Register
Employees To effectively manage risk as part of their
job and report hazards or risks to their Service Managers.
Risk Management Reporting
Members
Hold CMB accountable for the effective management of risk by
Council Officers Organisation.
Audits and Standards Committee Review Risk Management strategy and monitor development of risk
management
Directorate Management Teams - (DMT)
§ Assess & prioritise risks to Service Delivery Plans and Objectives
§ Monitor Risk
Management progress, including Business Continuity Planning and report to CRMG § Can seek assistance
from members of CRMG § Communicate with &
involve employees in Risk Management § Facilitate workshops to
assign risk responsibility in Directorates
§ Identify and exchange information on emerging hazards with CRMG § Analyse information § Identify hazards tonew
projects/changes to service delivery
Corporate Management Board - (CMB) § Ensure that the
Council manages risk effectively, through the development of a Corporate Strategy § To consider Strategic Risks that may threaten the Council’s Vision and other strategies
Corporate Risk Management Group (CRMG) Report to CMB quarterly including:
• Group Work Plan
• Trends and potential movements in Strategic Risks
• Cost of risk
• Common areas of risk for projects
Form sub groups as required for common projects e.g. Business Continuity, Health & Safety, and Information Security
Attend DMT meetings as required to provide information and discuss common issues as the need arises.
Issue appropriate advice as common themes are identified
Heads of Service Manage risks in service areas, compile Risk Register and report to DMT
Employees
Liaise with Manager to assess risks and report any hazards or risks in their job
Skills and Expertise
8. Having established roles and accountabilities for risk management, the Council must ensure that it maintains the skills and expertise necessary. It is achieving this by a programme of risk management training and learning opportunities that addresses the needs of Members and Officers – this programme will not be “one size fits all”.
9. The programme includes relatively high level risk appreciation seminars aimed at Senior Managers (including Directors) and more detailed and intensive courses focusing on best practice in risk management. Training and awareness courses also focus on specific risks already identified in areas such as the following:
• Risk Management awareness (Members and Officers)
• Business Continuity • Partnership working • Health & Safety issues
Risks and the Decision Making Processes
10. Risk needs to be addressed at the point at which decisions are being taken. Where Members and Officers are asked to make decisions they should be advised of the risks associated with recommendations being made. The training programme described in the preceding section enables this to happen.
11. However, the Council needs to be able to demonstrate that it took reasonable steps to consider the risks involved in a decision. Decisions will be requested through reports to the Corporate Management Board (CMB) and Members and risk implications must be addressed within these reports.
12. There needs to be a balance struck between the efficiency of the decision making process and the need to address risk. Risk assessment is seen to be particularly valuable in options appraisal.
13. Current reports for decisions are expected to address any appropriate options that have been considered. This would be an appropriate point at which to address the risks involved with those options. This doesn’t guarantee that decisions will always be right. but the important point is to demonstrate that the risks have been considered and to have evidence that will support this.
Supporting Improvement
14. Risk Management has been incorporated into the business planning process for all Divisions with a risk assessment of all services being undertaken as part of drawing up Service Delivery Plans. Risk control measures feed into Service Improvement Plans. Risk Management Assisting Project Management
15. A consistent approach to identifying, assessing and controlling risk has been adopted and included in the Council’s project management system. This is being used in all major Council projects, including the development of all Council Strategies.
Integrating Risk Management with Performance Management
16. Risk Management has been integrated into the existing performance management system, primarily through the use of risk analysis in the formulation of Service Delivery Plans and monitoring of Corporate Plan Objectives.
Involvement of Elected Members
17. Elected Members have a key contribution to make to the assessment of risks to the objectives of Corporate Strategies and must be included in assessment exercises. Reports to Cabinet and Committees include a demonstration that risks have been addressed. An annual report to Cabinet will be made that will review existing Risk Management arrangements, identify key Strategic Risks and the way in which they will be managed.
Toolkits, Procedures and Guidelines
18. Toolkits for Risk Management and Contract Management which form part of a series of initiatives have been referred to Corporate Management Board. Further details of these initiatives are provided in Section 8, Risk Management developments.
Performance Management
19 A performance management framework has been developed to monitor the impact of risk management activities and the success of the Risk Management Strategy itself. Individual indicators have been developed to measure achievement of the aims and objectives. The following table forms the basis of the performance management framework.
Aim/Objective Indicator Measurement Integration of Risk
Management into Culture of the Council and raising awareness of Risk Management
• Staff recognising their role and responsibility for Risk Management in their area
• Number of reports for decision that
demonstrate risk assessment
• Responses to Audit and Inspection reports
• By annual survey of staff (extension of existing surveys) • By audit of reports and
documentary evidence of decisions
• By audit of responses
Enabling and managing
Change • Assessment of how we managed
individual major changes.
• By post event analysis
Minimisation of losses,
injury and inconvenience • Number and length of disruptions to services • Levels of Fraud
• Level of complaints • Levels of Write-Offs • Level and cost of
Claims
• Measure response and
recovery performance as well as frequency • Informed by existing strategies and processes. Introduce Risk Management Framework
• Feedback from staff • Compliance with
standards
• Did we do it? • Is it any good? Minimising Cost of Risk • Annual Insurance
Premiums
• Level of Reserves
• Uninsured Losses
• Management and
Project Costs
• Will incorporate budget and capital project overspends, fraud, write-offs, claims, premiums etc. plus any loss in external
