1-
1
Audit Committee
Date: 26 June 2006
Report of:Director of Regulatory Services
Subject:RISK MANAGEMENT - QUARTERLY REPORT
SUMMARY
This report provides the committee with the latest update on progress being made on the Risk Management Strategyand in tackling the top risks identified on the corporate risk register.
RECOMMENDATION
The progress made to date is noted.
au-060626-r09-ehav2
1-
1
INTRODUCTION
- Risk management is a key component of an organisation’s corporate governance framework. It is considered best practice by the Audit Commission that a member committee has responsibility for “corporate risk management” and “receives reports at least quarterly and takes appropriate action to ensure that corporate business risks are being actively managed”.
- This report provides the committee with the latest position in relation to :
- Implementing the Risk Management Strategy
- Managing the risks on the Corporate Risk Register
Risk Management Strategy
- The Council’s risk management arrangements are laid out in our Risk Management Policy and Strategy. The former sets out the framework and the latter includes an assessment of our arrangements and an action plan for improvement.
- There has been a delay in the annual revision of the documents which will now be presented at the September meeting of the Committee. However, below is the progress made to date on improving our risk management framework.
Annual Audit of Arrangements
- The new annual inter-authority audit of risk management arrangements has now been completed. This has assessed our arrangements across the following 8 headings:
- Vision, Commitment and Ownership
- Structure, roles and responsibilities
- Identifying risks
- Categorising and prioritising risks
- Action and response
- Monitoring and review
- Extended enterprise (partnerships)
- Embedding risk management
- Fareham BC have been assessed by Basingstoke and Deane BC as being at the “Risk Defined” stage whilst being well on the way to being at the “Risk Managed” stage using the scale overleaf which was developed by the Institute of Internal Auditors.
- An action plan has now been compiled which will form the basis of the Risk Management Strategy for 2006/7. No “essential” recommendations have been made and most relate to embedding processes already in place.
Institute of Internal Auditors Risk Maturity Matrix
Risk Naïve / Risk Aware / Risk Defined / Risk Managed / Risk EnabledNo formal approach developed for risk management / Scattered silo based approach to risk management / Strategy & policies in place and communicated. Risk appetite defined / Enterprise approach to risk management developed and communicated / Risk management and internal controls fully embedded into operations.
Management of Registers
- Considerable progress has been made on the previous Strategy action plan since last year. The table below summarises the latest position on the management of registers in the formal hierarchy.
Register / Update on Position
Members’ Register / Risk Register Completed
Monitoring arrangements have been launched and the risks have been selected for discussion at the Executive Briefing meetings since March, using briefings prepared by officers:
Risks covered so far
009 - Increased impact of crime disorder and vandalism
010 - Long term customer dissatisfaction with refuse and recycling service
005 - Failure to comply with the statutory duty towards homeless families
006 - Failure to meet affordable housing target
015 - Failure to meet the target for reduction in use of temp accommodation for homeless
Corporate Register / Risk Register Completed and Updated
Monitoring information is discussed later on in the report.
Operational Registers / Service Registers
Further progress has been made by officers in finalising their Business Service Registers such that 92% (58) are now in place. 4 Chief Officer registers are also being used.
Employer Registers
Further progress has been made by officers in finalising their Business Employer Registers such that 83% (15) have now been finalised and monitoring arrangements commenced. Once all completed some cross council analysis can be carried out on this information.
Meetings are being arranged to help officers finalise the few that remain with a target date of the end of June.
Partnership Registers / Project Integra (In place)
Partnership risks have been identified and are being monitored as part of the business plan
Building Control (In place)
Partnership register in place and being monitored.
CCTV
Partnership register in place. Action plan to be agreed and monitoring arrangements launched after the restructure in June.
Portchester Crematorium
The Joint Committee have now approved the introduction of the risk management framework proposed. Operational registers are being developed first.
Community Safety
Partnership risks have been identified. Mapping to controls and agreement of action plan yet to be done and will be progressed once the restructure has settled.
Business Continuity Plans
- Consultants (JLT) have now been appointed and have started their review of our Corporate Business Continuity Plan. Initial feedback in relation to our ICT contingency arrangements is very positive.
- They will also be developing a new template and methodology that can be used to develop departmental continuity plans.
The Corporate Risk Register
- A full list of the corporate risks is shown in Appendix B. An additional risk in relation to an “outbreak of avian flu” has recently been identified by the Strategic Risk Management Group and approved by the Chief Executive’s Management Team for addition to the register. The results of the risk assessment on this risk will be reported at the next meeting.
- Although all risks and reduction actions on the Corporate Risk Register are monitored throughout the year, in accordance with the Risk Management Policy, monitoring of risk management activity for the Corporate Risk Register is especially concentrated on any risk assessed as a “category 1” risk.
- There are now 7 category 1 risks on the register. Appendix C summarises these risks and the progress made to date to address the risks. Generally, good progress is being made to address all of these risks and this is likely to be reflected in the next risk assessments assigned to these risks (due in August).
risk assessment
- Attached to this report at Appendix A is a risk assessment. There are no significant issues to highlight.
CONCLUSION
- Significant progress has been made in relation to the Corporate Risk Management Strategy and actions are being implemented to tackle the council’s top risks.
Background Papers:
None
Reference Papers:
Report to the Executive 10/10/05on revised Corporate Risk Register
Report to the Executive 6/12/04 onRisk Management Policy and Strategy
Enquiries:For further information please contact Elaine Hammell(Ext4344)
au-060626-r09-ehav2
1-
1
APPENDIX A
RISK ASSESSMENT
Impact / Description / Potential Risks / Comments / Potential Opportunities / CommentsCORPORATE OBJECTIVES / Implications in relation to:
- achieving Corporate Objectives and Priorities
- Corporate Governance Responsibilities
PARTNERSHIPS / Implications for any existing partnership arrangements
Risks or opportunities for new partnerships / No significant risks / No significant opportunities
FINANCIAL / Implications in relation to:
- Budget Constraints
- Funding
- Contractual Obligations or Penalties
- Use of Land or Assets
LEGAL / Implications in relation to:
- Statutory or discretionary powers
- National Legislation (e.g. Human Rights, Equal Opportunities, Race equality etc)
- Failing to comply with legislative requirements of service
- Potential litigation action
PERSONNEL / Implications in relation to:
- Organisational change
- Employee policies and conditions
- Skill availability
- Training and Development
SERVICE / Implications in relation to:
- performance targets
- the operation of the service
- the need for Change Management
- Competitive advantage of the service
- Technological impacts
- Innovation
- The needs of residents, businesses or visitors to the Borough
- Social inclusion
HEALTH & SAFETY / Implications for the Health Safety of the Public, Employees or Members / No significant risks. / No significant opportunities.
CRIME & DISORDER / Implications in relation to:
- Council’s Section 17 Obligations
- Community Safety
ENVIRONMENTAL / Implications in relation to:
- Sustainability
- Public Health
- Physical risks
au-060626-r09-ehav2
1-
1
APPENDIX B
Full List of Risks on the Corporate Risk Register 2005/6
(N.B. Risk Categories are allocated on a scale of 1 to 6 with a category of 1 indicating High Risk. The Risk Management software assigns the category based on the probability and the highest impact that the risk manager has given in their assessment of the risk.)
Risgen Ref / Risk / AssignedRisk Manager / Risk Category
2005/6
3 / Failure to provide suitable accommodation for the homeless / Martyn George / 1
33 / Failure to Meet Affordable Homes Target / Martyn George / 1
34 / Failure to Meet Recycling Target / Jim Kettlewell / 1
15 / Claims for damage caused by Council Trees / Jim Kettlewell / 1
38
NEW / Loss of Power Supply / Garry White / 1
39
NEW / Building Control Partnership does not meet its objectives / Alan Wells / 1
41
NEW / Claim in relation to Legionella / Garry White / 1
43
NEW / Failure to implement the most favourable management option for Ferneham Hall / Carol Bolton / 2
27 / Non Completion of Local Development Framework (LDF) within time period agreed with Secretary of State / Richard Jolley / 2
13 / Key Paper Records (e.g. Deeds for Council’s assets) are lost or damaged / Peter Grimwood / 2
14 / Major breach of ICT security / Peter Harper / 2
16 / Loss of Council Transport Operator’s Licence / Jim Kettlewell / 2
17 / Failure of the new Leisure Trust / Jim Kettlewell / 2
26 / Failure to provide an appropriate response to an emergency / Garry White / 2
28 / Major Enviro/Socio/Economic change. Resilience of the Borough / Garry White / 2
35 / Receiving an acceptable CPA assessment (fair or below) / Peter Grimwood / 2
36
NEW / Implementation of Customer Service Centre does not meet its objectives / Lynne Hickey / 2
23 / Ineffective Local Strategic Partnership (change name) / Peter Grimwood / 2
40
NEW / Claim in relation to Asbestos / Garry White / 2
42
NEW / Failure to ensure effective implementation of Decriminalised Parking enforcement / Andy Viccars / 2
5 / Failing to guard against damage claims (i.e. inadequate insurance cover) / Keith Thompson / 3
6 / Major loss or reduction of income to the council / Keith Thompson / 3
9 / Failure to change in line with modernisation agenda / Peter Grimwood / 3
10 / Inability to demonstrate that the Council has achieved its aims and objectives / Peter Grimwood / 3
18 / Major breach of corporate Health and Safety responsibilities (internal) / Peter Grimwood / 4
19 / Violence against employees / Sarah Robinson / 4
21 / Sickness absences not adequately managed / Sarah Robinson / 4
1 / Ineffective or non relevant procurement procedures/decision / Gina Bailey / 4
8 / Major Budget Variance / Keith Thompson / 5
12 / Loss of IT infrastructure – less than 2 days / Peter Harper / 5
4 / Loss of major services / Carol Bolton / 5
7 / Missed opportunities on external funding e.g. grant claims, other bids / Keith Thompson / 5
11 / Receiving an unacceptable external assessment e.g. CPA, BFI, External Audit / Peter Grimwood / 5
20 / Major human resource issue. / Peter Grimwood / 5
2 / Major incident of fraud or corruption (external or internal) / Elaine Hammell / 5
22 / Poor public relations (damage to Council reputation) / Sue Rance / 5
24 / Breakdown of officer/ member relationships / Alan Davies / 5
25 / Any corporate strategy within the policy framework not fit for purpose / Peter Grimwood / 5
29 / Loss of major asset or supplier / Andy Viccars / 5
30 / Provision of incorrect information to customers / Gina Bailey / 5
31 / Major non-compliance with legislation or regulations / Gina Bailey / 5
32 / Loss of IT infrastructure – more than 2 days / Peter Harper / 5
37
NEW / Failure to achieve efficiency Savings (Gershon) / Carol Bolton / 5
au-060626-r09-ehav2
1-
1
APPENDIX C
Summary of Progress and Action Taken on Top Corporate Risks
(2005-6 register)
Risk Ref / Risk / Progress To DateRisks Previously on the Register
03 / Failure to provide suitable accommodation for the Homeless / Good progress made on risk action plan with 12/14 actions fully complete.
Homeless preventative role of Housing Options Team reducing homeless cases by 60%. Pool of private sector accommodation improved.
From 1 April 2005 to 31 March 2006, the Council accepted 109 homeless households and placed them in good quality, self contained temporary accommodation. During the same period 3 families were placed in bed and breakfast accommodation, no homeless families were placed in bed and breakfast accommodation for more than six weeks.
33 / Failure to meet Affordable Homes Target / Good progress made on risk action plan with 14/16 actions fully complete.
At 31 March 2006 the Council had directly enabled 44 new affordable dwellings to be completed (10 of which are located outside of the borough). A further 13 low cost shared ownership homes were provided within the borough by Swaythling Housing Society.
Although the target of 100 new affordable homes has not been met in 2005/06, the Council gave planning permission for 184 new affordable homes which will help ensure the target is met in future years. There are currently 133 units on site and a further 184 units with planning consent.
In October 2005, RSL’s and developer’s submitted bids to the Housing Corporation under the National Affordable Housing Programme totalling £34 M to build 682 new affordable homes in Fareham over the next 5 years. The Housing Corporation recently announced the results of the bidding round allocating £6.35 M to fund the construction of 139 new affordable homes in Fareham over the next two years. In recent discussions with the Housing Corporation officers have been advised that an additional £5M will be made available for Hunts Pond Road and Coldeast if development commences within the next two years.
34 / Failure to meet recycling target / Good progress made on risk action plan with 10/12 actions fully complete.
Major changes introduced to the waste management service in September 2005 in order to meet recycling targets:
a) Alternative collections at the kerbside for household waste and recyclables
b) Free fortnightly collection of garden waste
c) Exclusion of garden waste from household waste.
The first 7 months of the new arrangements have delivered a 32.13% recycling rate. To help achieve the 40% target, a bid has been made to Project Integra to introduce programmes;
- to reduce contamination and non-participation
- to include “hard to reach” groups
- to increase data capture and management
- to increase stakeholder involvement
- to improve crew training
- to engage further with the community
- The Fareham and Gosport Real Nappy Network
- Volunteer Recycling Champions Group
15 / Claims for Damage caused by Council Trees. / Good progress made on risk action plan with 8/15 actions fully complete.
A new tree and parks officer has been appointed to zone and map the Council’s trees in accordance with the Tree Management Policy. Officers have reviewed the process for dealing with tree enquiries to ensure an efficient handover to the Customer Service Centre.
Aproject has been approved for the digitising of plans and maps relating to the Council’s land assets. Land ownership in Sarisbury ward has been completed along with a desk top exercise of zoning of the trees on council land, using the base data collated during the mapping of council land project.
There is a delay on the purchase of the mobile GIS as it has been necessary for the GIS Support and Development Officer to resolve a number of issues relating to the integration between cartology, ocella and the mobile GIS product that we hope will meet FBC’s requirements for remote capture of corporate GIS data in the future.
This obviously has had an impact on the progress of inspection and recording of the condition of any Council owned trees. At this stage the only progress that can be made is to continue to zone the trees on Cartology and to undertake visual inspections of the trees that have been identified in the red zones and keeping records of such. This isn’t an ideal solution but it does show a commitment to proactive tree management in case of future insurance claims.
New Category 1 Risks on the 2005-6 Register
38 / Loss of Power Supply / Detailed report provided to the last Audit Committee. 7/10 risk actions completed.
A standby generator is located in the basement of thecivic offices that would cut in automatically in the event of a loss of power and this would supply approximately one third of the power required by the building.
If the loss of power was prolonged there would be a focus on the provision of the key priority services that are identified within the Corporate Business Continuity Plan (currently being updated). If there was a sustained loss of power then measures would be put in place to limit and decant key operations within the civic offices to the first four floors of the building. Full use would be made of the ground floor and the Customer Service Centre. When this facility was designed and built it was flood wired, provided with additional network points and was designed to run on a maintained circuit.
The ICT systems and servers on floor one and the main Private Branch Exchange (PBX) supporting 236100 are served by an Uninterrupted Power Supply (UPS) system that would kick in and would operate from the maintained supply powered by the generator. External servers also provide real time back up so that there would be no loss of data.
Work has also been undertaken at the depot to enable services operating from this facility to be maintained by the use of a generator which would be used in the event of a loss of power at this location. This has been tested and can power all the equipment at the depot such as the computer systems, lighting, electrics, vehicles repair facilities and the electric fuel pumps that supply all the vehicles that operate out of the depot.
39 / Building Control Partnership does not meet its Objectives / 1/4 risk actions completed.
Audit review of Corporate Governance Arrangements completed and action plan drawn up.A new comprehensive partnership agreement with Gosport has recently been signed which addresses a number of the risk areas identified with partnership working.
Inter-authority workshop held to draw up strategic risk register for the partnership and action plan. Officer and member panel monitoring implementation of the actions.
41 / Claim in relation to Legionella / 8/14risk actions completed.
Council Legionella policy drawn up. Corporate framework introduced to co-ordinate Health and Safety risks from council buildings. A register has also been developed that details the current status of assessments and monitoring of all Council owned / controlled premises for not only Legionella, but also for asbestos, fire risk assessments and the requirements of the Disability Discrimination Act.
Initial health check of buildings completed to identify any specific or emergency action work needed. Risk Assessments of all premises undertaken. Executive approval of £100K to undertake improvement works. Monitoring programme being implemented.
au-060626-r09-ehav2