Risk Appetite Statement
Risk Appetite Statement
Our risk appetite guides how much risk we are willing to seek or accept to achieve our objectives. We recognise we will need to take risks, both in our ordinary business and to achieve the priorities set out in our Strategic Plan. Good risk management ensures we make well informed decisions and we understand the associated risks. By ensuring that we properly respond to risks we will be more likely to achieve our priorities. It also provides control and a high level of due diligence consistent with our responsibilities in managing public money.
We recognise effective risk management considers not just threats but also opportunities. So, our approach to risk is to seek the right opportunities and, where possible, minimise threats. By encouraging managed risk taking, and considering all of the available options we seek a balance between caution and innovation.
Our risk appetite reflects our current position; encouraging managed risk taking for minor to moderate level risks, but controlling more closely those risks that come further up the scale. Our appetite for risk will vary over time depending on our ambitions and priorities and the environment we work in.
Beyond our risk appetite is our risk tolerance. This sets the level of risk that is unacceptable, whatever opportunities might follow. In such instances we will aim to reduce the risk to a level that is within our appetite.
We illustrate our risk appetite and tolerance in the matrix below. The RED> shaded area represents the outer limit of our risk appetite, and the BLACK area indicates the tolerance. As a Council we are not willing to take risks that will cause a significant negative consequence for our objectives.
The matrix also illustrates how we monitor risks. The Council’s highest level risks (those with a combined score of 12 and above) are reported to Corporate Leadership Team for consideration and guidance.
|1 - Minimal||2 - Minor||3 - Moderate||4 - Major||5 - Catastrophic|
|Likelihood||5 - Almost Certain||Monitor Quarterly||Monitor Quarterly||Monitor Monthly||Monitor Monthly to CLT||Monitor Monthly to CLT|
|4 - Likely||Monitor 6-Monthly / Annually||Monitor Quarterly||Monitor Monthly||Monitor Monthly||Monitor Monthly to CLT|
|3 - Possible||Monitor 6-Monthly / Annually||Monitor Quarterly||Monitor Quarterly||Monitor Monthly||Monitor Monthly|
|2 - Unlikely||No Action Required||Monitor 6-Monthly / Annually||Monitor Quarterly||Monitor Quarterly||Monitor Quarterly|
|1 - Rare||No Action Required||No Action Required||Monitor 6-Monthly / Annually||Monitor 6-Monthly / Annually||Business Continuity Plan|
|Risk Rating||Risk Rating|
Risks at this level sit above the tolerance of the Council and are of such magnitude that they form the Council’s biggest risks. The Council is not willing to take risks at this level and action should be taken immediately to manage the risk.
|12-16||These risks are within the upper limit of risk appetite. While these risks can be tolerated, controls should be identified to bring the risk down to a more manageable level where possible.|
|5-10||These risks sit on the borders of the Council’s risk appetite and so while they don’t pose an immediate threat, they are still risks that should remain under review. If the impact or likelihood increases then risk owners should seek to manage the increase.|
|3-4||These are low level risks that could impede or hinder achievement of objectives. Due to the relative low level it is unlikely that additional controls will be identified to respond to the risk.|
|1-2||Minor level risks with little consequence but not to be overlooked completely. They are enough of a risk to have been assessed through the process, but unlikely to prevent the achievement of objectives.|
|Rare events that have a catastrophic impact form part of the Council’s Business Continuity Planning response.|