• No results found

Autism Bedfordshire. Risk Management Matrix Plan. Registered Charity and Company Limited by Guarantee. Charity no: Company no:

N/A
N/A
Protected

Academic year: 2021

Share "Autism Bedfordshire. Risk Management Matrix Plan. Registered Charity and Company Limited by Guarantee. Charity no: Company no:"

Copied!
46
0
0

Loading.... (view fulltext now)

Full text

(1)

Appendix 6

Autism Bedfordshire

Risk Management Matrix Plan

2014 – 2015

(2)

Contents

A. Introduction ... 6

B. Mission/objectives ... 7

The Charity’s aims/ objectives do not accord with the Constitution ... 7

Activities and future developments restricted by objects ... 7

The Charity lacks direction, strategy and forward planning ... 8

C. Law and regulation ... 8

Failure to operate within Charitable Objects ... 8

Breach of statutory requirements (e.g., Health & Safety at Work legislation, Charities Act, Companies Act, Trustees Act etc.) ... 9

Adverse Charity Commission monitoring visit ... 9

Penalties or restrictions imposed following control visits ... 9

D. Governance and management ... 10

Structure/membership of the Board of Trustees and managing committees is inappropriate ... 10

Relationship between the Board of Trustees and senior staff is poor... 11

Reporting to the Trustees is inadequate... 12

Problems exist with senior management team (supervision, communication) ... 13

Dominance of key individual(s) on the Board of Trustees ... 14

Trustees are benefiting from the charity ... 15

Conflict of interest ... 16

Lack of strategic plan, or poorly implemented ... 17

E. External factors ... 18

Change in political regime/direction. ... 18

(3)

Social and demographic changes ... 19

F. Operational factors ... 20

Reputation impact of event, fraud, accident, media coverage etc. ... 20

Supplier dependency/ difficulties/ bargaining power ... 21

Contract risk – onerous terms, uncompetitive ... 21

Safeguarding of assets (insurance, maintenance, etc.) ... 22

Intellectual property inadequately protected ... 22

Physical security or abuse of staff ... 23

Capacity and use of resources including tangible fixed assets ... 23

Competition from other bodies ... 23

Poor security of office from/equipment unauthorised usage ... 24

Lack of control of third party users ... 24

Lack of planning & control of offsite activities e.g., trips & expeditions ... 24

Lack of written policies and procedures or failure to keep them up-to-date ... 25

Disaster recovery procedures in place ... 25

Breach of regulations e.g. Data protection Act, Food Standards, Children’s Act ... 25

G. Human resources ... 26

Loss of key members of staff – i.e., lack of succession-planning ... 27

Difficulties in recruiting/retaining staff ... 27

(4)

Dependence on a key individual ... 30

Poor recruitment procedures ... 31

H. Environmental ... 31

Difficulties with residential home planning applications and highway access clearance ... 31

I. Technological ... 32

Increased need to invest in new technology/ poor use of IT ... 33

Failure of key software/hardware ... 33

Weak systems selection and implementation procedures ... 33

Lack of disaster recovery planning, including backups ... 34

J. Financial ... 35

Weak or ineffective financial controls and ... 36

Inadequate financial planning and forecasting ... 36

Poor or inaccurate financial reporting and management accounts ... 36

Income levels inadequate ... 37

Poor investment management and performance ... 37

Qualified external audit report ... 37

Unplanned tax/VAT liabilities ... 38

Inadequate or inappropriate insurance cover ... 38

Capital expenditure plans not defined ... 38

Lack of a reserves policy ... 38

K. Funds and fundraising ... 39

Sensitive cash flow situation resulting in pressures to meet financial commitments and adversely impacting operational activities ... 40

Uncompetitive or unrealistic charges ... 40

(5)

Guarantees to third parties ... 41

Pension commitments are not being met ... 42

Failure to meet fundraising targets ... 42

Poor control of fundraisers ... 42

Lack of control of branches and support groups ... 42

Breach of Inland Revenue rules on small scale trading ... 43

Non-compliance with laws and regulations regarding fund raising activities, including use of professional fundraisers ... 43

L. Fraud ... 44

Lack of consideration of the potential for fraud ... 44

Poor employee education and understanding of the implications of fraud ... 45

Response to fraud is inappropriate ... 45

(6)

A.

Introduction

Purpose of this document

This document sets out the key risks as assessed by the Trustees, both financial and non-financial. The document records the

assessment made by the Organisation and is to be revisited on a regular basis.

The relative importance of each of the risks identified has been assessed – through consideration of the likelihood of incidence and

the potential impact on Autism Bedfordshire. The matrix uses a simple scoring system as follows:

Likelihood

(3) Likely

Expected – more than even chance of happening

(2) Possible

Possible – even chance of happening

(1) Remote

Extremely unlikely

Impact

(3) Critical

Will make a material difference

(2) Major

Will make a difference

(1) Manageable

Impact deemed to be manageable

Likelihood

Remote

Possible

Likely

-1

-2

-3

Impact

Critical (3)

M (3)

H (6)

H (9)

H = High Risk

Major (2)

L (2)

M (4)

H (6)

M = Medium Risk

L = Low Risk

Manageable (1)

L (1)

L (2)

M (3)

(7)

B.

Mission/objectives

Risk Factor Risk

Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process Further Action Required

The Charity’s aims/

objectives do not

accord

with

the

Constitution

L(1)

1 1

Protocol for reviewing new projects to ensure consistency with objects, powers and terms of funding and consistency with Constitution AGM 2014 to present proposed changes, aligned with 3 Year Strategic Plan and as recommended by solicitors Park Woodfine Heald Mellows LLP Senior Manager and Board of Trustee’s. Formal Review following AGM in November board meeting 2014. To be formally reviewed annually by Senior Manager and Board of Trustee’s. Set out a strategic plan which set out key aims, objectives and policy.

Activities and future

developments

restricted by objects

M(4)

2 2

Protocol for reviewing new projects to ensure consistency with objects, powers and terms of funding Senior Manager and Board of Trustee’s. Included in Formal annual review. Considered in Working Group meetings relating to To be formally reviewed annually by Senior Manager and Board of Trustee’s and in Working Group meetings.

(8)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process Further Action Required

The Charity lacks

direction,

strategy

and

forward

planning

L(1)

1 1

Creation of a strategic plan which sets out the key aims, objectives and policies

Creation of financial plans and budgets

Monitoring of financial and operational performance

Senior Manager and Board of Trustee’s.

Monthly Board meeting to measure results against targets set in Strategic and

Operational Plan and monitor financial and operational

performance.

Ensure feedback is gathered from all stakeholder groups, including beneficiaries and funders.

C.

Law and regulation

Risk Factor Risk

Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Failure

to

operate

within

Charitable

Objects

M(4)

2 2

As above Senior Manager

and Board of Trustee’s.

(9)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Breach

of

statutory

requirements

(e.g.,

Health & Safety at

Work

legislation,

Charities

Act,

Companies

Act,

Trustees Act etc.)

M(4)

2 2

Policies and procedures

documented and communicated to visitors & staff as appropriate

Senior Manager and Board of Trustee’s – Service Manager to ensure training is delivered. Monthly Board meeting to monitor Health and Safety designated Trustee. Ensure Administrator is supported to keep up to date. Ensure feedback is gathered from all stakeholder groups, including beneficiaries and funders. Recruit Trustees from HR/Legal background to strengthen monitoring.

Adverse

Charity

Commission monitoring

visit

L(1)

1 1 As above As above As above As above

Penalties or restrictions

imposed

following

control visits

M(4)

2 2

Policies and procedures

documented and communicated to visitors & staff as appropriate

(10)

D.

Governance and management

Risk Factor Risk

Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process Further Action Required

Structure/membership of

the Board of Trustees

and

managing

committees

is

inappropriate

M(4)

2 2

Review of structure and constitutional change to ensure that the Board contains the necessary experience and skills Skills review

Competence framework and job descriptions Training and

Recruitment process Organisation chart and clear understanding of roles and responsibilities Senior Manager and Board of Trustee’s. Monthly Board meeting to monitor recruitment process and probation of new Trustee’s. Toolkit developed.

Annually review and agree recruitment process.

(11)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process Further Action Required

Relationship

between

the Board of Trustees

and senior staff is poor

H(6)

2 3

Formal and informal lines of communication are clearly understood and documented, as appropriate Senior Manager and Board of Trustee’s. Robust recruitment, training and probation period. Line manager of the board to bi – monthly supervise.

All board members to be accessible and performance management criteria to be followed. Team Build days to unite through common goals.

(12)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process Further Action Required

Reporting

to

the

Trustees is inadequate

M(4)

2 2 Proper strategic

planning, objective setting and budgeting processes

Timely and accurate project report Timely and accurate financial report Proper project assessment and authorisation procedures Regular contact between Trustees and management Senior Manager and Board of Trustee’s. Line Management – performance management criteria followed. Clear measurable targets set out in the strategic goals to report against.

Agree information and format to be shared. Timely reporting agreed, occurrence timed to include month end financial reporting.

Senior Manager and Board of Trustee’s governance and reporting training.

Ensure adequate support and resource is in place.

Performance management meetings arranged bi-monthly or more frequently to address the concerns.

Succession planning.

Regular contact links between board and team, i.e. Trustee to attend team meetings adhoc.

(13)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process Further Action Required

Problems

exist

with

senior

management

team

(supervision,

communication)

M(4)

2 2

Organisation chart and clear understanding of roles and

responsibilities

Competence framework and role descriptions Delegation and monitoring, which is documented and communicated, is consistent with good practice Senior Manager and Board of Trustee’s. Line Management – performance management criteria followed. Clear measurable targets set out in the strategic goals to report against.

Agree information and format to be shared. Timely reporting agreed, occurrence timed to include month end financial reporting.

Senior Manager and Board of Trustee’s governance and reporting training.

Ensure adequate support and resource is in place.

Performance management meetings arranged bi-monthly or more frequently to address the concerns.

Succession planning.

Regular contact links between board and team, i.e. Trustee to attend team meetings adhoc.

(14)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process Further Action Required

Dominance

of

key

individual(s)

on

the

Board of Trustees

M(4)

2 2

Consider the structure of the Board and their independence

Mechanisms agreed to deal with potential conflicts of interest Recruitment and appointment processes and constitutional validity Procedural framework for meetings and recording decisions Senior Manager and Board of Trustee’s. Reviewed monthly at board meetings. Review of structure and constitutional change to ensure that the Board contains the necessary experience and skills

Competence framework and job descriptions Training Recruitment process – probations and supervisions Organisation chart and clear understanding of roles and responsibilities

Exit Strategies made clear in Trustee Recruitment Toolkit.

Skills review and succession planning.

Mentoring and counselling support to ensure that Trustees can debrief to an independent person. Peer support to be formalised into the supervision that it provides.

(15)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process Further Action Required

Trustees are benefiting

from the charity

M(4)

2 2

Ensure legal authority for payment or benefit Terms and procedures to authorise/approve

expenses and

payments

Procedures and

methods to establish fair payment, conducted separately from “interested” Trustee Approved by the Board

Senior Manager and Board of Trustee’s.

Monthly board

meetings.

Financial checks and counter signatories for all expenses are a member of the Finance Team and Trustee.

Recruitment process and training on Volunteers and the Law made available to all Trustees and mandatory for new Trustee recruitment.

Finance Director to monitor governance expenditure, along with Senior Manager

(16)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process Further Action Required

Conflict of interest

L(2)

2 1 Understanding of trust

law

Protocol for disclosure of potential conflicts of interest

Procedures for standing down on certain decisions Recruitment and selection processes Senior Manager and Board of Trustee’s. AB adheres to the Nolan 7 principles which should be applied in public life.

These are:

selflessness, integrity, objectivity,

accountability,

openness, honesty and leadership. One important means by which Autism Bedfordshire may demonstrate that it is applying these principles is by maintaining a Register of Business Interests.

Annual review of recruitment and selection process.

Exit strategies included in recruitment process and toolkit. HR support available via HR contract with Bedford Borough Council.

(17)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process Further Action Required

Lack of strategic plan, or

poorly implemented

M(4)

2 2 Proper strategic

planning, objectives setting and budgeting processes in place, requiring Trustee approval Senior Manager and Board of Trustee’s. Monthly team

meetings for areas within the organisation to report back on targets against Strategic and Operational Plan. Monthly Board meetings to review and monitor progress against targets against Strategic and Operational Plan

Finalise 3 Year Strategic Plan and 1 Year Operational Plan, setting out; key aims, objectives and policies.

Create financial plans and budgets.

Use job plans and targets.

Monitor financial and operational performance.

Obtain regular feedback from beneficiaries and funders.

(18)

E.

External factors

Risk Factor Risk

Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Change

in

political

regime/direction.

M(4)

2 2

Monitoring of proposed legal and regulatory changes

Membership of umbrella bodies

Senior Manager and Board of Trustee’s. Monthly Board meetings. Stakeholder relationship events (i.e. AGM).

Ensure profiled is raised to demonstrate need, high quality and best value. Stakeholder

communications to be regular and effective

Change

in

public

perception of charities

M(4)

2 2

Communication with supporters and beneficiaries

Quality financial, annual report and review reporting

PR training/procedures Senior Manager and Board of Trustee’s. Monthly Board meetings. Stakeholder relationship events (i.e. AGM).

Ensure profiled is raised to demonstrate need, high quality and best value. Stakeholder

communications to be regular and effective. Devise Media, Marketing and Communications Plan.

(19)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Acts of God, impact of

adverse

weather

conditions

L(2)

1 2 State of repair of buildings kept under review. Formal facilities management arrangements. Repairs and maintenance budget

Appropriate insurance in place

Data Officer, Adult Services Manager and Administrator. Report monitoring to Senior Manager and Board of Trustee’s. Data Officer to complete weekly & monthly checklists.

Add all further actions required to checklist.

Agree IT Recovery Plan. Implement data backup procedures and review security arrangements. Review insurance cover. .

Changes

in

charity

taxation, including VAT

rules

M(4)

2 2 Formal monitoring of the

position to understand implications of changes

Working with specialists (appointed accountants) who provide appropriate advice

Senior Manager and Board of Trustee’s. Monthly Finance reports to include changes, impact and recommendations .

SORP training for Key Finance Personnel

(20)

F.

Operational factors

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Reputation

impact of event,

fraud,

accident,

media coverage

etc.

H(6) 2 3

Financial control procedures Segregation of duties Authorisation limits Security of assets Insurable risks

Complaints procedures (both internal and external)

Proper review procedures for complaints

Crisis management strategy for handling, consistency of key messages, nominated spokesperson etc Senior Manager and Board of Trustee’s – all stakeholders to be aware. Rigorous recruitment process, particularly with senior / finance related positions. Policies and procedures to reflect practice and with measures and safeguards to mitigate risks.

Ensure successes, assets and achievements are celebrated through all our communications and press articles.

Review the policies for Finance bi-annually and all policies minimum annually. Maintain good relations with all stakeholders.

Designated risk

(21)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Supplier

dependency/

difficulties/

bargaining power

L(2) 2 1

Use of competitive tendering for larger contracts

Procedures for obtaining quotations Authorised suppliers listing

Monitoring of quality/timeliness of provision

Use of service level agreements Use of buying consortia

Senior Manager and Board of Trustee’s and Administrator. Monthly reviews of suppliers and Administrator to check price comparisons.

Review and report concerns – ongoing.

Contract risk

onerous

terms,

uncompetitive

M(4) 2 2

Cost/project appraisal procedures Authorisation procedures

Professional advice on terms and

Senior Manager and Board of Trustee’s and Monthly reviews of suppliers and Administrator to check price

Review and report concerns – ongoing.

(22)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Safeguarding

of

assets

(insurance,

maintenance,

etc.)

L(1) 1 1 Review of security

Asset register and inspection programme

Facility management arrangements Safe custody arrangements for title documents

Management of patent and intellectual property Insurance reviews Senior Manager and Board of Trustee’s and Administrator. Bi-annual reviews of suppliers and Administrator to check price comparisons.

Review and report concerns – ongoing. Ensure that checklists are held up to date and any new contracts relating to office premises hire are screened by AB solicitor.

Intellectual

property

inadequately

protected

L(1)

1 1 Registration of trademarks and

patents

Security of electronically held data

Senior Manager and Board of Trustee’s and Administrator. Bi-annual reviews of suppliers and Administrator to check price comparisons.

Review and report concerns re transparency – ongoing.

(23)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Physical security

or abuse of staff

M(4)

2 2 Review of security

Recruitment procedures – including vetting of staff and volunteers

Training and supervision procedures

Senior Manager and Board of Trustee’s, Child and Adult Service Managers. Bi-annual reviews of suppliers and Administrator to check price comparisons.

Review and report concerns – ongoing. Ensure that all contact is risk assessed and staff and volunteers are adequately trained for their roles, including health and safety training.

Capacity and use

of

resources

including tangible

fixed assets

L(1)

1 1 Building and organisation inspection programme

Repair and maintenance programme Capital expenditure budgets

Efficiency review

Senior Manager and Board of Trustee’s, Child and Adult Service Managers. Bi-annual reviews of suppliers and Administrator to check price comparisons.

Review and report concerns – ongoing.

(24)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Poor security of

office

from/equipment

unauthorised

usage

M(4) 2 2 Review of security

Authorisation procedures for usage of charity property Senior Manager, Assistant Development Officer and Facilities Manager. Keep checklist of all equipment, and ensure all items are co-signed in and out.

Establish system and also add to exit interview paperwork.

Lack of control of

third party users

M(4)

2 2 Review of security

Training and supervision procedures

Senior Manager, Assistant Development Officer and Facilities Manager. Keep checklist of all equipment, and ensure all items are co-signed in and out.

Establish system and also add to exit interview paperwork.

Lack of planning

& control of offsite

activities

e.g.,

trips

&

expeditions

M(4)

2 2 Review of security

Review and communication of procedures

Recruitment procedures – including vetting of staff and volunteers

Training and supervision procedures

Senior Manager, Senior Finance Officer and Finance Director

Restrictions and petty cash control sheet. £100 limit for petty cash. No authorised expenditure above £50 without Senior Managers signed consent.

Debit card policy and procedure and limited to Senior Manager as the card holder.

(25)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Lack of written

policies

and

procedures

or

failure to keep

them up-to-date

M(4)

2 2 Proper documentation of policies and

procedures

Audit and review of systems

Senior Manager and Board of Trustee’s.

Annual review in May and June.

HR BBC and AB solicitors to support ensuring that they are kept up to date and audited annually.

Disaster recovery

procedures

in

place

M(3)

1 3 Disaster recovery plan and

procedures in place addressing operations in addition to IT

Training, performance management and bi-monthly supervisions of Senior Team. Senior Manager and Board of Trustee’s. Monitor funding and performance monthly.

Annual service scoping to establish order and cover of services to be cut depending on local provision and priorities.

Breach

of

regulations

e.g.

Data

protection

Act,

Food

2 3 Appropriate policies and procedures in place; documented and communicated to visitors and staff as appropriate

Senior Manager and Board of Trustee’s.

All staff and volunteers to follow a robust recruitment

Inductions and training logged.

(26)

G.

Human resources

Risk Factor Risk

Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

(27)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Loss of key members

of staff

i.e., lack of

succession-planning

M(4)

2 2

Succession planning

Documentation of systems, plans and projects

Training programmes

Notice periods and handovers Recruitment processes Board of Trustee’s, Senior Manager and Senior Management Team. Monthly board reports and meetings; bi-monthly supervisions; Appraisals. Performance Management, pay scales audits.

Staff retention monitored and reported annually.

Difficulties

in

recruiting/retaining staff

M(4)

2 2 Established recruitment process,

subject to regular review

Review of staff performance and salary levels

Marketing and advertising activity

Board of Trustee’s, Senior Manager and Senior Management Team. Staff retention monitored and reported annually. If 3 key staff resigns within 3 months, the board

need to

investigate.

Target skills and experience required and all advertising avenues; social media, press, internally and targeted.

(28)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Failures in staff-vetting

procedures

H(6)

2 3 Recruitment processes

Reference and qualification checking procedures, job descriptions, contracts of employment, appraisals and feedback procedures

Job training and development Health and safety training and monitoring

Staff vetting and legal requirement checks Senior Manager and Senior Management Team and Assistant Development Officer. Recorded bi annual sample quality control checks on staff and volunteer file.

Annual HR checks against information requested.

Poor working practices

e.g. discrimination or

bullying

H(6)

2 3 Equal opportunities policies in

place – documented and communicated

Where inappropriate behaviour identified appropriate action taken Senior Manager and Senior Management Team and Assistant Development Officer. Senior teams to monitor and deliver supervision programs.

Training and Induction –

documented and

(29)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Poor staff morale

M(4)

2 2 Interview and assessment

processes

Fair and open competition appointment for key posts

Job descriptions, performance appraisal and feedback

Conduct “exit” interviews

Consider rates of pay, training, working conditions, job satisfaction Senior Manager and Senior Management. Supervisions, Appraisals, team meetings, board meetings, team days and open door

communication and support available.

External support via ICT Counselling Support Service made available to all staff and volunteers.

Poor or lack of terms

and conditions

M(4)

2 2 Job descriptions, contracts of

employment, appraisal and feedback processes in place

Senior Manager and Senior Management Team. Senior teams to monitor and deliver supervision programs.

Training and Induction –

documented and

(30)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Poor staff training and

development

M(4)

2 2 Job descriptions and formal

appraisal process

Training needs formally identified and addressed Senior Manager and Senior Management Team and Assistant Development Officer. Senior teams to monitor and deliver supervision programs and performance monitoring appraisals.

Training and Induction –

documented and

communicated

Inadequate supervision

or control of volunteers

M(4)

2 2 Appropriate policy documented

and communicated to staff and volunteers

Monitoring and assessment of supervision Senior Manager and Senior Management Team and Assistant Development Officer. Senior teams to monitor and deliver supervision programs and contribution reviewed.

Training and Induction –

documented and communicated

Dependence on a key

individual

M(4) 2 2 Succession planning

Documentation of systems, plans and projects

Training programmes

Notice periods and handovers

Board of Trustee’s, Senior Manager and Senior Management Team. Monthly board reports and meetings; bi-monthly supervisions; Appraisals. Performance Management, pay scales audits.

Staff retention monitored and reported annually.

(31)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Poor

recruitment

procedures

M(4)

2 2

Procedures documented and reviewed Board of Trustee’s, Senior Manager and Senior Management Team. Performance and retention monitored and reported.

Training and induction programmes recorded and evaluated.

H.

Environmental

Risk Factor Risk

Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

(32)

I.

Technological

Risk Factor Risk

Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

(33)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Increased need to invest

in new technology/ poor

use of IT

M(4)

2 2 Appraisal of systems needs and

options IT Support Consultant and Senior Manager. Bi – annual reviews of Service Level Agreement.

Feasibility study conducted to validate proposed significant increases.

Failure

of

key

software/hardware

H(6)

2 3 Security and authorisation

procedures and Implementation and development procedures Use of service and support contracts

Disaster recovery procedures Outsourcing and Insurable loss

Senior Manager, Adult Services Manager and IT Support Consultant. Weekly logged backups to remote hard drive. SLA inclusive of maintenance checks.

Internal additional backups of SAGE and ABShare, shared drive.

Weak systems selection

and

implementation

procedures

2 2 Appraisal of systems needs and

options Senior Manager, Adult Services Manager and IT Support SLA inclusive of assessment of needs.

Internal additional backups of SAGE and ABShare, shared drive

(34)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Lack of disaster recovery

planning,

including

backups

H(6)

2 3 IT recovery plan and Insurance

cover and Data backup procedures and precautions

Disaster recovery plan for alternative accommodation Senior Manager, Adult Services Manager and IT Support Consultant. SLA inclusive of assessment of needs and detailed recovery plan.

Internal additional backups of SAGE and ABShare, shared drive

External hard drive updated weekly by Adult Services Manager

(35)

J.

Financial

Risk Factor Risk

Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

(36)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Weak

or

ineffective

financial controls and

Inadequate

financial

planning

and

forecasting

H(6)

2 3

Budgets linked to business planning and objectives

Proper costing procedures for product or service delivery

Adequate skills base to produce and interpret budgetary and financial report

Procedures to review and action budget/cash flow variances

Chair, Finance Director, Board of Trustees and Senior Manager, Senior Finance and Funding Officer. Finance Working Group Bi-annual meetings. Board meetings – Finance Reports. Timely and accurate monitoring and reporting AB Accountant – Garner Associates to meet bi-annually re forecasting, policies and procedures and year end audits.

Poor

or

inaccurate

financial reporting and

management accounts

H(6)

2 3 As above Chair, Finance

Director, Board of Trustees and Senior Manager, Senior Finance and Funding Officer. Finance Working Group Bi-annual meetings. Board meetings – Finance Reports. AB Accountant – Garner Associates to meet bi-annually re forecasting, policies and procedures and year end audits.

(37)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Income

levels

inadequate

H(6)

2 3 Policies and procedures

for approval of charges and income levels (budgets)

Marketing strategy and capability Review and assessment of competitor markets and strategies

Chair, Finance Director, Board of Trustees and Senior Manager, Senior Finance and Funding Officer. Finance Working Group Bi-annual meetings. Board meetings – Finance Reports. Re-establish priorities. 1. Increasing revenue/income streams. 2. Cuts to services.

Poor

investment

management

and

performance

M(4) 2 2 Investment policy

Proper investment advice or management

Diversity, prudence and liquidity criteria

Adequate reserves policy Regular performance monitoring

Chair, Finance Director, Board of Trustees and Senior Manager, Senior Finance and Funding Officer. Finance Working Group Bi-annual meetings. Board meetings – Finance Reports. Re-establish priorities. 1. Increasing revenue/income streams. 2. Cuts to services.

(38)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Unplanned

tax/VAT

liabilities

M(4)

2 2 Monitoring of the position to ensure compliance

Senior Finance Officer and Senior Manager.

Real time tax paid monthly and VAT checked with HMRC.

AB Accountant – Garner Associates to meet bi-annually re forecasting, policies and procedures and year end audits.

Inadequate

or

inappropriate insurance

cover

M(4)

2 2 Review of insurance requirements

Policies and procedures for negotiating insurance terms and claims Board of Trustee’s, Administrator and Senior Manager. Annual checklist for Insurance Charity Commission

submissions and quality control checks.

Capital

expenditure

plans not defined

M(4)

2 2 Appropriate budgeting processes

requiring Trustee approval

Regular monitoring of performance and capital expenditure

Board of Trustee’s, Administrator and Senior Manager. Monthly Finance Reports and Finance Working Groups.

3 Year and 1 Year Strategic Plans.

All expenditure greater than £1000 co signed by Finance Director and Senior Manager.

Lack of a reserves

policy

M(4)

2 2 Appropriate reserves policy

approved by the Trustees and communicated

Reserves policy fully explained in the Annual Trustees’ report

Board of

Trustee’s and Senior Manager.

Revised annually for the Annual

Report and

Published Accounts.

Reviewed in bi-annual Finance Working Groups.

(39)

K.

Funds and fundraising

Risk Factor Risk

Likelihood (low, medium or High) Risk Impact (low, medium or High)

Control Procedure Individual Responsibility

Monitoring Process

(40)

Risk Factor Risk Likelihood (low, medium or High) Risk Impact (low, medium or High)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Sensitive

cash

flow

situation resulting in

pressures

to

meet

financial commitments

and

adversely

impacting

operational

activities

H(6) 2 3

Adequate cash flow projections (prudence of assumptions) Identification of major sensitivities Adequate information flow from operational managers

Monitoring arrangements and reporting Senior Manager, Finance Director and Senior Funding and Finance Officers. Monthly report on accounts and cash flow. Forecast reviews monthly board reports. Finance Working Groups Agreement in principal with CAF Bank re: temporary overdraft facility and loan options.

Uncompetitive

or

unrealistic charges

M(4)

2 2

Procedures to agree charges (budgets)

Procedures for approval of variations to charges (budgets)

Senior Manager, Finance Director

and Senior

Funding and Finance Officers.

Child and Adult Working Groups Stakeholder consultations and evaluations

Annual review of fee’s and comparisons to other voluntary organisations.

Non-compliance

with

donor / funder imposed

restrictions

M(4)

2 2 Systems to identify restricted

receipts

Budget control, monitoring and reporting arrangements Senior Manager, and Senior Funding and Finance Officers. Monthly Funding and Finance meetings. Accounts nominal coding Variation agreements sought or funding returned.

(41)

Risk Factor Risk Likelihood (low, medium or High) Risk Impact (low, medium or High)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Deterioration

in

relationship

with

funders

H(6)

2 3 Regular contact and briefings to major funders

Project reporting

Meeting funders terms, conditions and requirements

Senior Manager, Child and Adult Services Managers. Monthly Board reports Bi-annual and quarterly reporting.

Contracts clearly outlining expectations and output and outcomes to be reported on.

Inappropriate

terms

and

uncompetitive

borrowing rates

M(4) 2 2

Appraisal of future income streams

Appraisal of terms (rates available, fixed, capped, variable etc.)

Property advice procedures

Senior Manager, Finance Director and Senior Funding and Finance Officers. Project Management of all new projects with clearly identified funding streams and strategies

Senior Manager, Finance Director assess need against plans

Guarantees

to

third

parties

L(1)

1 1 Approval and authority

procedures

Procedures to ensure consistency with objects, plans and priorities

Senior Manager, Finance Director and Senior Funding and Finance Officers. Monthly Board reports Bi-annual and quarterly

Senior Manager, Finance Director assess need against plans

(42)

Risk Factor Risk Likelihood (low, medium or High) Risk Impact (low, medium or High)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Pension commitments

are not being met

M(4)

2 2 Review and approval of monthly

payroll

Senior Manager & Senior Finance Officers.

Monthly payroll and pension reporting

Senior Manager and Finance Director monthly co-sign.

Failure

to

meet

fundraising targets

H(6)

2 3 Monitoring of performance

Appropriate reserves policy in place Senior Manager and Senior Funding Officer Monthly reporting to the board. Monthly funding meetings Effective annual forecasting and monitoring.

Repeat grant funding secured.

Poor

control

of

fundraisers

M(4)

2 2 Fundraisers issued with formal

guidance booklet

Formal targets/budgets set and performance monitored against targets Senior Manager and Senior Funding Officer Monthly reporting to the board. Monthly funding meetings

Lack

of

control

of

branches and support

groups

M(4)

2 2 Appropriate reporting lines and

information requirements established

Formal targets/budgets set and performance monitored against targets Senior Funding Officer and Service Managers Sessional returns Restricted purchases and limited petty cash

Training and Induction – documented

(43)

Risk Factor Risk Likelihood (low, medium or High) Risk Impact (low, medium or High)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Breach

of

Inland

Revenue rules on small

scale trading

M(4)

2 2 Appropriate monitoring of trading activity

Establishment of trading subsidiary or other vehicle

Senior Finance Officer and Senior Manager.

Real time tax paid monthly and VAT checked with HMRC.

AB Accountant – Garner Associates to meet bi-annually re forecasting, policies and procedures and year end audits.

Non-compliance

with

laws and regulations

regarding fund raising

activities, including use

of

professional

fundraisers

H(6)

2 3 Appraisal, budgeting and

authorisation procedures

Review of regulatory compliance Monitoring of the adequacy of financial returns achieved (benchmarking comparisons) Complaints review procedures

Senior Funding Officer and Senior Manager. Monthly Funding meetings Monthly reporting to the board AB Accountant – Garner Associates to meet bi-annually re forecasting, policies and procedures and year end audits. AB adheres to charity Commission guidance: http://www.charitycommis sion.gov.uk/detailed- guidance/money-and- accounts/internal- financial-controls-for-charities-cc8 Recruitment, Induction

(44)

L. Fraud

Risk Factor Risk

Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Lack

of

consideration

of

the potential for

fraud

M(4)

2 2

Fraud is assessed as a risk

The different types of fraud to which the charity is exposed have been identified and appropriate policies, procedures and responsibilities for managing the risk are in place

Senior Manager and Board of Trustees Annual compliance checks of all policies and procedures.

Funding and Finance training to be under taken by key staff in funding, finance and management.

(45)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Poor

employee

education

and

understanding

of

the implications of

fraud

M(4) 2 2

The charity has a fraud policy statement which is communicated to all employees

The fraud policy statement is regularly reviewed for compliance and updated

A fraud prevention education/training programme is in place

The charity has a clear whistle-blowing policy

Recruitment and ongoing personnel policies are in place, which address the risk of fraud

Senior Manager and Board of Trustees Annual compliance checks of all policies and procedures.

Funding and Finance training to be under taken by key staff in funding, finance and management.

Response to fraud

All instances of suspected fraud are investigated The board of Trustees and Financial Controls, Policies A documented plan of action is in place to be

(46)

Risk Factor Risk Likelihood remote (1), possible(2) or likely (3) Risk Impact manageable (1), major (2) or critical (3)

Control Procedure Individual Responsibility

Monitoring Process

Further Action Required

Poor

internal

controls

which

impinge on ability

to detect fraud

M(4)

2 2 Policies, procedures and controls in place in respect of the transaction and accounting systems

Controls in place over the security of assets/property

Track cash donations

Appropriate budgeting and management accounting and other reporting in place to aid monitoring of performance Senior Manager, Senior Officers, Finance Director and Board of Trustee’s Rigorous background checks recruitment for key staff and volunteers

Senior team to carry out fraud risk assessment, including both prevention and detection methods Key staff to attend training to identify fraud

Whistle blowing policy communicated

Fraud action plan to be created

References

Related documents

Relative positioning is “relative” to the element’s initial position in the flow of the document, whereas absolute positioning is “relative” to nearest positioned ancestor or,

[r]

The Dunhill Medical Trust: a company limited by guarantee Registered in England: Company Number: 7472301 Registered Office: 6 New Bridge Street EC4V 6AB Registered Charity

We calculate cumulative abnormal returns around the effective dates of on-the-list events for each individual stock, and, by examining whether it is significantly different from

Treatment of durable tree species by removal of their extractives reduced their resistance to termites signifi cantly (P < 0.05).. In other words, removal of extractives increased

Senior Management Team  Responsible for risk assessment, management, monitoring and reporting to the Executive Director for all risks relative to their areas

Jersey group at an international microbiology conference in Rome, Italy. The New York Times and the Washington Post reported the discovery. However, upon the

Figure 8.2 Login interface.. Figure 8.3 View all employees in the company interface.. Figure 8.4 Administrator create/edit employees details interface.. Figure 8.5 Individual