Contact your Parish Council

Corporate Risk Update – April 2018

Introduction

Effective risk management is a vital part of the Council’s governance, and contributes greatly to the successful delivery of services and the key priorities. The Council has always recognised and supported the need to have effective risk management processes, and so, in February 2016 updated and refreshed procedures and guidance.

As part of this work, we (Mid Kent Audit) took lead responsibility to co-ordinate and embed revised risk management processes across the Council. Our role includes reporting regular updates to Officers and Members, through the Corporate Leadership Team (CLT), Policy & Resources Committee and the Audit, Governance & Standards Committee. We also provide support and training to help ensure that risks are being effectively managed.

Having valuable and up to date risk information allows for both the management and oversight functions to happen effectively. Executive management has the role to identify the right risks, and review the substance of each risk to ensure that responses and actions are correct and that risks are being actively managed.  Oversight is provided by the Audit, Governance & Standards Committee as those charged with governance, who seeks assurance that the Council operates an effective process.

In our last update in October 2017, the Committee adopted the risk appetite statement. This framework sets the risk tolerance levels, and guides risk owners on how to report, address and monitor their risks (see appendix 1B). Following the adoption of the risk appetite statement we have designed this update to show how this has been applied across the Council, with the focus being on the high level risk issues. 

Mid Kent Partners

At the corporate level, our risk register reflects those strategic level risks that could have a much wider impact on the services we deliver, and how we operate as an organisation. The external environment is complex, and new risks are emerging all the time. So it is important that the process is designed to enable the fluid movement of risks as they emerge, become managed and eventually removed from the register. We appraise our external environment in various ways, including horizon scanning and through strategic planning, but also by working closely with our partners. 

Through the internal audit function we support and deliver the risk management process across our Mid Kent partners, this includes Tunbridge Wells and Swale (through MKS) but also Ashford (as part of the audit partnership). This enables us to capture insight across the other sites and gain a greater understanding of similar risk issues facing each Council. Partnership working allows us to share these insights, and where possible develop and strengthen strategies in how we respond to key risk issues.

For instance, the introduction of the General Data Protection Regulations (GDPR) in May 2018 presents significant risks for all organisations, not just the Council. Through our work with governance working groups across Swale and Maidstone we have been able to support the inclusion of this risk into the corporate risk register. We are then able to share information to assist with the implementation of key controls to help manage the impact of the risk.

The figure below shows some of the highest scored corporate (and strategic) risks for each of the partners. From this high level view we are able to see some clear risk themes:

Risk Themes

As risk management becomes more consistently embedded across our partners it will be possible to gain a richer understanding of how similar risks are being managed. This can also be extended out more widely across the Public Sector. In time this will enable us to refine our risk responses, and to share effective strategies and key controls to managing these risks.

Corporate Risk Update - April 2018

The Council’s corporate risks are those risks which could impede the achievement of our strategic objectives.  The corporate risk register was last reported to Members in October 2017 following a full exercise to update and refresh them in accordance with our priorities and operational risk themes. 

The matrices below provide a snapshot of the corporate risk profile, with the location on the matrix being dependent on the score of risk likelihood and impact.  This is based on the inherent risk, i.e. the risk impact and likelihood considering any existing controls in place to manage the risk, but before any further planned controls are introduced.  For a base comparison we have included the profile from the previous risk update:

The following table illustrates the risk heading and summarises how the risk has moved between October 2017 and April 2018:

Since October 2017 the Council has identified two new Corporate Risks (j and k). 

GDPR has been added to the corporate risk register to reflect the prominence of the potential impact of the new legislation. Previously, this risk was managed through separate entries on two operational risk registers (Policy & Information and MKS ICT services). 

The contraction of the retail and leisure sector risk was also previously an operational risk (Economic Development). However, due to the potential significant impact on the sector caused by online shopping patterns, this has been escalated to the corporate risk register.

Other changes in the Corporate Risk Register are summarised below:

·         (a) Legal / Compliance Breaches: Reference to GDPR has been removed and the controls in place to manage the risk have been updated.  This has led to an overall reduction in the risk score.

·         (d) Project Failure: The implementation of some of the controls which were planned in October 2017 has led to a reduction in the overall risk score.

·         (g) Housing Pressures: This risk has been updated to incorporate an operational risk around the Homelessness Reduction Act.  Existing and planned controls have been updated to incorporate actions from this risk but at this stage it is too early to judge if implementation will lower the inherent or residual risk scores.

·         (h) Local Plan Review: This risk has been redefined following successful adoption of the Local Plan (LP). The risk now reflects the challenges relating to the LP Review and the delivery of outputs of the existing LP.  Existing and planned controls have been fully updated and the risk score has been re-evaluated.

Through review of the matrices it is clear to see the reduction in overall likelihood and impact for 2 of the 3 previously rated BLACK risks. There is however still one risk that sits above the Councils tolerance (risk g: Housing Pressures).  Controls have been identified to manage this risk down to a more acceptable level and as outlined in the risk appetite guidance, Corporate Leadership Team are receiving monthly updates from the Housing Service which allows them to monitor progress and provide guidance, support and focus where needed. 

Further detail on the corporate risks, including a description of the risk and details of existing and planned key controls can be found in Appendix 1A.

Operational Risks

All Council services maintain an operational risk register. Collectively, these registers form the comprehensive risk register, and it is this complete register that is used to compile the risk update reports on a regular basis. These operational level risks across the Council underpin how we determine the corporate risks. For instance, if we start to see similar operational risks across multiple services, we can escalate those risks to the corporate level to ensure that a holistic approach to managing the risk is taken, across the entire organisation.

Operational risks are the responsibility of the services to manage, and so fall within the remit of our Managers and Heads of Service. However, in accordance with the risk appetite, risks continue to be reviewed and monitored based on overall score.

The following matrix shows the operational risk profile for the Council. This is based on the inherent risk, i.e. the risk impact and likelihood considering any existing controls in place to manage the risk, but before any further planned controls are introduced.  The table shows the number of risks for each colour category.

These risks are managed in accordance with the Council’s Risk Appetite Statement, whereby services routinely monitor their risks based on the risk score (see Appendix 1B).  Quarterly risk updates are presented to Corporate Leadership Team (CLT) on all risks above the Councils appetite – i.e. those risks which are Red or Black (22 in total).

While there are currently no BLACK risks, they would feature more frequently on the CLT agenda. This is also the case should the circumstances for an existing risk change such that the score is increased.  Monitoring of these high level risks enables more effective challenge on the effectiveness of controls, and also means that support can be put in place to help manage the impact of the risk.

By taking this joined up approach to include operational and corporate level risks, we are able to much more effectively manage the risks being identified, and use the risk management process to capture issue before they arise.

Next Steps

Risk management is a continuous process, and to be valuable it must be updated and maintained. Moving forward into 2018/19, the following areas will be our focus in order to further strengthen the risk management process and develop a positive risk culture across the Council:

1.      To undertake the first full review of the framework: The framework has been operating for nearly 3 years, and so it is about the right time to review and where necessary update the framework to ensure that it remain fit for purpose;

2.      Develop a training programme: We (Mid Kent Audit) have continued to facilitate workshops, and deliver risk sessions as and when requested. However, developing the overall knowledge and expertise for risk management across the Council requires a wider approach. We will be looking to develop a training session for managers and officers on the principles of risk management, and to tailor that with the framework and procedures;

3.      Enhance risk information and insights: We will be undertaking a review of key controls and also drawing together thematic information on key risk areas – this will mean we can provide a richer level of risk information and start to identify similarities / root cause issues across the Council;

We have also recently procured an audit management system. Enterprise risk management tools are built into the software which will potentially enable us to be smarter and more efficient with how we maintain the risk register and how we generate risk information.

There have been significant improvements to how the Council manages risks over the last couple of years. Moving the Council to a position where risk management is adding real value and insight, and where processes are far more advanced than many other public sector and some private sector organisations.  This wouldn’t have been possible without the great deal of positive engagement and support from Senior Officers and Managers in the Council. So, we’d like to take this opportunity to thank officers for their continued work and support.

Appendix 1A

Corporate Risks

The table below sets out each of the corporate risks in detail. Risk owners have assessed the impact and likelihood of the risks and identified the key controls and planned actions necessary to further manage the risk to an acceptable level: 

Appendix 1B

Maidstone Risk Management Process: One Page Summary

Risk Appetite – Monitoring Process

We illustrate our risk appetite and tolerance in the matrix below. The RED shaded area represents the outer limit of our risk appetite, and the BLACK area indicates the tolerance. As a Council we are not willing to take risks that have significant negative consequences on the achievement of our objectives.

The matrix also illustrates how we monitor risks. The Council’s highest level risks (those with a combined score of 12 and above) are reported to Corporate Leadership Team for consideration and guidance.

Appendix 1C

Impact & Likelihood Scales

Risk Impact

Risk Likelihood