Maidstone Borough Council Risk Register Update
Risk Register Summary
In February 2016 the Council’s comprehensive risk register contained 213 risks. The operational risks were identified across all Council services through risk workshops conducted by the Mid Kent Audit team. An externally facilitated session was conducted by Grant Thornton to identify corporate risks with Senior Officers and Members.
Throughout the summer, the audit team have met with risk owners to review and update the high level risks (those scoring 15 or more) to establish the actions taken and the effect of those actions on the overall impact and likelihood of risks (definitions for the impact and likelihood scores are attached in appendix I).
As a result of this update we have seen an overall decrease in the number of risks, from 213 to 187. The majority of these relate to project risks where projects have now been closed (for instance Debt Recovery and Planning Support). However, there has been the addition of some newly identified operational risks and removal of risks which are no longer relevant.
The risk matrices below plot the overall risk profile of the Council based on the mitigated risk scores for likelihood and impact. For a base of comparison we have included the profile from the previous risk update in February 2016:
Risk summary by total:
Risk Colour |
February 2016 |
September 2016 |
Difference |
Scored 1-2 |
6 |
5 |
-1 |
Scored 3-4 |
64 |
58 |
-6 |
Scored 6-10 |
114 |
108 |
-6 |
Scored 12-16 |
26 |
15 |
-11 |
Scored 20-25 |
3 |
1 |
-2 |
TOTAL |
213 |
187 |
- 26 |
There has been some movement in risks following the update to the register, most notably a reduction in red rated risks. For the purposes of this report, key risks are those scoring 15 and above.
Risk Themes
We took time during the review of risk registers to identify and allocate a classification type to each risk. By doing this we are able to gain greater insight into common risk areas and potential themes. While not all of the risks on the register will fit nicely into a single classification, there were 4 main types of risks that featured more prominently than others. These areas are:
· Staffing: 25% (44 service risks) relate to risks around staffing pressures, resilience, skills gaps or pay and conditions.
· Finance: 15% (27 service risks) relate to risks around funding pressures/gaps, lack of commercial investment or non-achievement of income targets.
· Customer: 12% (22 service risks) relate to risk that could prevent services from meeting customer expectations or risks that could result in reputational damage.
· Information Technology: 8% (14 service risks) relate to risks around IT failure or integrity and development of key systems.
We will continue to draw insights from the risk work across the Council, and also from the external environment and good practice guides. Mid Kent Audit supports the delivery of risk management services to varying degrees across the Mid Kent Partners. As this work progresses we will also be able to draw insights from our partner authorities and others across Kent. However, for the time being, as this work is still underway we will continue to monitor themes and trends within the risk register and address key issues with risk owners accordingly.
So what are the key risks?
The table below is an extract from the comprehensive risk register. The table includes all of the corporate level risks, along with any high scoring operational risks. This is the first time that this level of detail has been reported, and so we have sought to show any relationships between corporate level risks and operational risks within the table. This more clearly shows the flow of risks from the operational level up to corporate level.
Service & Ref |
Risk (title & full description) |
Risk Owner |
Key Existing Controls |
Inherent rating |
||||||
I |
L |
∑ |
||||||||
Corporate 1 |
Lack
of progress on transport infrastructure |
William Cornall & Rob Jarman |
-
Liaison with partners |
4 |
4 |
16 |
||||
Corporate 2 |
Increasing
difficulty in recruiting & retaining skilled staff |
Alison Broom & Steve McGinnes |
- Pay review |
4 |
4 |
16 |
||||
|
Operational Building
Surv. |
Retention
and recruitment of professional staff |
David Harrison |
- Added
market supplements (although no effect on recruitment) |
4 |
4 |
16 |
|
||
|
Operational Economic
Dev |
Skills
shortage |
John Foster |
- Working with Mid Kent College, KMEP, and MEBP on skills development issues. |
3 |
5 |
15 |
|
||
Corporate 3 |
Significant
commercial failure |
William Cornall |
- CLT
monitoring |
5 |
3 |
15 |
||||
Corporate 4 |
Not
agreeing local plan |
William Cornall & Rob Jarman |
- Local Plan consultation |
4 |
3 |
12 |
||||
Corporate 5 |
MKIP
fails to develop a coherent vision for its future |
Alison Broom & Steve McGinnes |
- MKIP
Board |
4 |
3 |
12 |
||||
Service & Ref |
Risk (title & full description) |
Risk Owner |
Key Existing Controls |
Inherent rating |
||||||
I |
L |
∑ |
||||||||
Corporate 6 |
Further
financial restriction |
Mark Green & Ellie Dunnet |
-
Efficiency statement |
5 |
2 |
10 |
||||
|
Operational Economic
Dev |
Restriction
in access to government funding through SELEP/KMEP |
John Foster |
-
Feedback to KCC |
4 |
4 |
16 |
|
||
Corporate 7 |
Over
cautious administration |
Alison Broom & Angela Woodhouse |
- Governance review |
3 |
2 |
6 |
||||
Corporate 8 |
Demographic
change |
Alison Broom |
- Residents' survey |
2 |
2 |
4 |
||||
Corporate 9 |
Slow
or inaccurate decision making |
Mark Green & Angela Woodhouse |
- Governance review |
2 |
2 |
4 |
||||
Corporate 10 |
IT
requirements progress faster than budget allows |
Mark Green & Andy Cole |
- ICT Commissioning Group |
3 |
1 |
3 |
||||
All 10 corporate risks on the register will be updated over the next couple of months, to ensure that they remain current. Most of these risks were identified at the beginning of the year, and so we will be working with the risk owners to update the risk descriptions, and then to identify any related risk actions necessary to manage the impact and likelihood of the risks.
Corporate risks by their very nature are more broadly linked to the achievement of the Council’s priorities. Therefore, by keeping the corporate level risks under review and updated, the Council is able to remain aware of the key risks and barriers to the achievement objectives, and react and take action accordingly.
Housing & Homelessness
Perhaps one of the key insights provided from the risk assessments at the operational level was the identification of some significant risks being faced by the Council’s Housing Service. Four of the Council’s highest scored risks come for the operational risks associated with Housing, and the challenges around Homelessness:
Service & Ref |
Risk (title & full description) |
Risk Owner |
Key Existing Controls |
Inherent rating |
||
I |
L |
∑ |
||||
Operational Housing |
Housing
market failure leading to an increase in homelessness approaches |
Ellie Kershaw |
- Triage service in place. - Monthly and quarterly reports on service indicators, raising resourcing needs. |
5 |
5 |
25 |
Operational Housing |
Lack
of suitable temporary accommodation options |
Ellie Kershaw |
-
Securing Maidstone owned TA |
5 |
4 |
20 |
Operational Housing |
Lack
of affordable housing |
Andrew Connors |
- Adopted
Affordable Housing DPD -
Emerging Local Plan Policy |
4 |
4 |
16 |
Operational Housing |
Inability
to access affordable private rents in Maidstone |
Ellie Kershaw |
- Survey of local landlords regarding current MBC incentive. - Best
practice review approach of other local authorities Social Lettings services.
|
3 |
5 |
15 |
This is a good example of where we are seeing the raising of risks from the bottom up, with the operational level identifying potential consequences based on higher risk impact and likelihood.
What are we doing about the risks?
A key function of any risk management process is deciding what (if any) action should be taken to address the identified risks. The Council’s risk management framework requires action to be taken to manage any risks that fall within the Black/Red rating. The purpose of risk action is to reduce either the impact or likelihood of the risk.
Figure 1: High level risks (inherent)
Likelihood |
5 |
|
|
2 |
1 |
|
4 |
|
|
3 |
1 |
||
3 |
|
|
|
|||
2 |
|
|
|
|
|
|
1 |
|
|
|
|
|
|
|
|
1 |
2 |
3 |
4 |
5 |
|
|
Impact |
This matrix shows the operational risks with an impact and likelihood score of 15 or above.
These risks may be more likely to occur, and if they do, the consequences are more significant and could prevent the Council and Service from delivering its objectives.
There are 7 risks that inherently sit above the risk appetite of the Council.
Figure 2: High level risks (residual)
Likelihood |
5 |
|
|
1 |
||
4 |
|
|
|
2 |
|
|
3 |
|
3 |
1 |
|||
2 |
|
|
|
|||
1 |
|
|
|
|
||
|
|
1 |
2 |
3 |
4 |
5 |
|
|
Impact |
This matrix shows the movement of the 7 high level risks, following the identification of planned controls and the re-assessment of the impact and likelihood.
The residual risk assessment takes into account controls that are planned, or where additional action needs to happen in order to manage the risk down to an acceptable level.
The re-assessment of these risks leaves 3 risks that, even with planned actions and controls, sit above the risk appetite of the Council. We provide further details of these risks below.
As we progress with the implementation and embedding of the risk management process, the audit team will meet with risk owners on a regular basis to review the effectiveness of the controls and the effect on the risk impact and likelihood. This will take place over the course of the next few months, as we begin to update and refresh risk registers to complement the service plans as we move into 2017/18.
The table below provides details on the planned actions that the Council will take in order to manage the risk, and the effect that this is likely to have on the overall risk rating:
Service & Ref |
Risk Title |
Risk Owner |
Inherent rating |
Controls planned |
Effective Date |
Mitigated rating |
||||
I |
L |
∑ |
I |
L |
∑ |
|||||
Operational Housing |
Housing market failure leading to an increase in homelessness approaches |
Ellie Kershaw |
5 |
5 |
25 |
Continuous
delivery of a range of affordable housing. Improvements made to reduce unit
cost of homelessness. Requests made for additional staffing proposed to
improve preventions. Business continuity planning to deal with emergency
situations. Recruiting bus improvement officer to ident efficiencies w/in
service |
Ongoing |
5 |
5 |
25 |
Operational Housing |
Lack of suitable temporary accommodation options |
Ellie Kershaw |
5 |
4 |
20 |
Increase
the number of directly owned TA through purchase and convert. Continuing to find
more providers. Make deals with London boroughs to use proportion of their
properties |
Ongoing |
4 |
4 |
16 |
Operational Building
Surv. |
Retention and recruitment of professional staff |
David Harrison |
4 |
4 |
16 |
Need to address remuneration restrictions |
March 2017 |
4 |
4 |
16 |
Operational Housing |
Inability to access affordable private rents in Maidstone |
Ellie Kershaw |
3 |
5 |
15 |
MBC investigating purchasing property. |
Ongoing |
3 |
4 |
12 |
Operational Economic
Dev |
Restriction in access to government funding through SELEP/KMEP |
John Foster |
4 |
4 |
16 |
Discussions with MPs |
Autumn 2016 |
3 |
3 |
9 |
Operational Housing |
Lack of affordable housing |
Andrew Connors |
4 |
4 |
16 |
Review
s106 schemes, viability evidence and property types to be delivered in order
to maximise affordable rent |
On going |
3 |
3 |
9 |
Operational Economic
Dev |
Skills shortage |
John Foster |
3 |
5 |
15 |
Bus/education partnership task & finish group |
01/09/2016 |
3 |
3 |
9 |
As a result of the Council’s response to the high level risks, and the planned actions, 3 of the 7 risks can be managed down to the amber level.
Next Steps
All risk owners involved in the review and update of their risks have been really engaged and positive about the process, and so we intend to build on this over the coming months to ensure that the risk profile and awareness remains at a good level, and so that we can continue to make improvements to the effectiveness of the process.
One significant piece of work being undertaken is to support the Council in establishing and articulating risk appetite and tolerances. This will provide guidance around the amount of risk that the Council is willing to seek or accept in pursuit of its long term objectives. In September 2016 we presented CLT with a number of different approaches which could be used. With an agreed format in mind, the next steps will be for us to engage with Members and Senior Officers about how we best reflect the Councils philosophy to risk taking, into an overall appetite statement. We anticipate this work to begin in November 2016.
Further key next steps include:
· Discussions are under way with Policy and Information about integrating risk management with the Council’s service planning process.
· Establish a web presence on the Council’s intranet in order to increase awareness of the Risk Management process and allow access to key documents and templates – November 2016.
· In association with Policy and Information adapt the Covalent system to reflect the Risk Management Framework and upload all identified risks into the system – December 2016.
· A template has been developed and disseminated to managers to facilitate the integration of risk assessment into the Council’s decision-making process and to promote a positive risk culture. Further work is ongoing to ensure that this is embedded.
Definitions