Risk Management

Strategy

Version17 – June 2023

Name of Policy The Risk Management Strategy

Policy Owner/s Assurance Board
Date Reviewed September 2023
 Contents
Executive Summary ......................................................................................... 2
Introduction ...................................................................................................... 2
Definitions ........................................................................................................ 3
Risk ........................................................................................................................................ 3
Risk management .................................................................................................................. 3
Why is Risk Management important? .............................................................. 3
Risk Policy Statement ...................................................................................... 3
The Risk Management Process ....................................................................... 4
1. Identification ................................................................................................................... 4
2. Evaluate ......................................................................................................................... 7
Risk Categories .................................................................................................................. 9
3. Planning ....................................................................................................................... 11
4. Implementation ............................................................................................................ 12
5. Embedding and Reviewing .......................................................................................... 13
Developing and Integrating Risk Management .............................................. 13
Risk Assessment ........................................................................................... 14
Risk Appetite .................................................................................................. 15
Option Appraisals & Risk Treatment .............................................................. 15
Roles and Responsibilities ............................................................................. 16
Council, Cabinet, Committees & Panels .............................................................................. 16
Cabinet ................................................................................................................................. 17
Corporate Governance Committee ...................................................................................... 17
Corporate LeadershipTeam ................................................................................................. 17
Senior LeadershipTeam ....................................................................................................... 17
Management Team .............................................................................................................. 17
Risk Officer, in collaboration with Assurance Board ............................................................ 18
Assurance Board .................................................................................................................. 18
Health and Safety................................................................................................................. 18
Internal Audit: ....................................................................................................................... 18
Employees ........................................................................................................................... 19
Appendix ........................................................................................................ 20
Glossary ......................................................................................................... 25
 Executive Summary
The purpose of the Risk Management Strategy is to communicate why and how
risk management should be applied throughout the organisation to support the
achievement of Huntingdonshire District Council’s (HDC) corporate objectives.
The corporate objectives can be found in the Corporate Plan 2023-2028 via the
Intranet. Is it essential for all staff to be familiar with risk management and their
responsibilities.

This strategy builds on the principles within HM Government’s Orange book1

which lays out the Management of Risk – principles and concepts, but does so
pragmatically accepting the guidance of this document that.

“Attempting to define a one-size-fits-all approach to managing risks, or to

standardise risk management practices, would be misguided because public
sector organisations are different sizes, are structured differently and have
different needs.”2

In order for HDC to have a successful risk management framework it is

essential that all staff are aware of the following points that are detailed in this
strategy…

 Understand what risk management is.

 Understand why risk management is highly important and aides the
achievement of the corporate objectives.
 Be aware of HDC’s Risk Management Statement.
 Know how to apply the risk management process model.
 Know how to complete a risk assessment.
 Be aware of your relevant departments risk appetite.
 Understand when to use the Option Appraisal and Risk Treatment forms.
 Understand your risk management responsibilities.

Introduction

An effective risk management strategy will ensure the Council maximises its
opportunities and manages those threats that may hinder the delivery of its
priorities so that the opportunities for continuous improvement are maximised.

Risk therefore needs to be considered at all stages of the management process,

from the setting of corporate priorities through to the delivery of the service to
the customer. Risk management therefore becomes an integral element of the
Council’s corporate governance arrangements.

This risk management strategy aims to integrate risk management into the
Council’s culture and processes and raise awareness amongst all employees

1 Orange book link: This links you to an online PDF version of The Orange Book Management
of Risk – principles and concepts, Crown Copyright, 2020
2 The Orange Book Management of Risk – principles and concepts, Crown Copyright, 2020.

P.3
and members of the benefits and opportunities that successful management of
risk can bring.

Definitions

Risk is the chance or possibility of something happening that will have an

adverse impact on the achievement of the Council’s objectives.

Risk management is the identification, evaluation, control, monitoring and

reporting of existing and emerging risks. It applies equally to the opportunities
for taking risks as it does to avoiding risks or reducing losses. It is a key part of
good management and not simply a compliance exercise.

Note: For further definitions please see the glossary.

Why is Risk Management important?

The Council provides a large range of services within an ever-changing

environment, so there is great potential for risks to arise. Effective risk
management will enable the Council to:

 Minimise disruption to service provision

 Maximise performance
 Minimise the need to divert funds from priority services
 Encourage creativity
 Minimise losses
 Ensure the Council’s reputation is preserved and enhanced
 Reduce insurance premiums

The aim is to manage risk, rather than eliminate it. Too little attention to
the control of risk will lead to unnecessary losses and poor performance,
while an over devoted approach may suppress creativity and increase the
cost of and/or impede service delivery. Successful risk management
means getting the balance right.

Risk Policy Statement

HDC is committed to the effective management of risk. The Council’s ability to

deliver services and achieve its business objectives are constantly affected by
risk, which the Council recognises as being both positive and negative.

The Council also recognises its legal, moral and fiduciary duties in taking
informed decisions about how best to control and minimise the downside of risk,
whilst still maximising opportunity and benefiting from positive risks.

The Council will ensure that Members and staff understand their responsibility
to identify risks and mitigate the possible consequences.
The Risk Management Process

The purpose of the risk management process guide is to describe the key steps
required to ensure risks are successfully identified, assessed, and controlled.

Risk management is a continuous process that has five key

elements/stages:

1. Identification: of risks to which the Council is exposed to.

2. Evaluation: of those risks in terms of likelihood and severity.
3. Planning: the control or mitigation of the risks, either by reducing the
likelihood or severity of adverse events.
4. Implementation: of the arrangements the Council needs to put into
place to deal with the consequences of the threats manifesting
themselves, e.g., insurance, levels of policy excesses, self-insurance,
service recovery planning
5. Embedding and Reviewing: the on-going monitoring and reporting of
risk, to allow for intended actions to be achieved and losses minimised.

A standard risk management process will be used throughout the Council. This
will ensure that risks are considered in the same fashion whether at a project,
partnership, corporate or operational level.

1. Identification

There are many ways of identifying risk, including making use of:
 Staff experience and knowledge
 Review of objectives in Corporate and Service Plans
 Performance indicators, financial/budgetary and management
information
  Service reviews by internal/external audit and other inspection bodies
 Risk assessments
 Directorate / Service meetings / workshops
 Amendments to legislation
 Insurance claims / loss information

When identifying risks, it is recommended to firstly, consider the context behind

the risk (why does the risk exist, what is the root cause) before identifying the
risks within it. This ensures the information about the planned activity/the scope
of it is gathered and it is clear how it fits into the wider organisation.

Context identification techniques include:

- Stakeholder analysis – who else is involved?
What do they think? This technique helps capture who the stakeholders
are, what their roles are and their level of participation. A stakeholder
analyses can be done for the entire organisation or
departments/divisions.
- Horizon scanning – What changes can we expect in the future?
By identifying and monitoring emerging risks and trends you are able to
proactively manage risks and take advantage of opportunities.
- Defining the probability/impact grid
As it is important to note specific details about the objectives before any
risks are identified. The probability impact grid technique defines the
impact scales for each relevant objective. These scales can then be used
to articulate risk tolerance thresholds for a particular organisational
activity.
- Strengths and weaknesses of the service/idea
This technique focuses on the analyses of the strengths (current fact),
weaknesses (current fact), opportunities (potential future fact) and
threats (potential future fact) of an individual, department, group or area.
- Assessing the political, economic, social, technological, legal and
environmental impacts (PESTLE).
This technique enables a wide scan of the context, and any potential or
actual factors that would affect any objectives if they were left
unmanaged. When doing a Pestle analysis ensure the assessment is
tailored to the specific organisation/area.
- Previous risks/lessons learned
Depending on the activity being worked on, it may be appropriate to
consider/examine previous lesson logs if available. These may include
details on events or activities which should or should not be repeated as
well as any relevant notes which may help with the current project/area.

Risk identification techniques include:

 Checklists: Reviewing risks and opportunities and possible actions.
 By preparing a list of potential risks and opportunities you can
systematically identify and assess risks to ensure no risks are
overlooked.
 Prompt lists: Lists triggering you to consider a range of factors
This technique involves asking open-ended questions which stimulates
discussion and helps identify potential risks that may not have been
considered.
 Risk descriptions: cause, event, effect
When writing a risk description ensure the cause, event and effect are
all written clearly which facilitates the development and understanding of
effective risk identification and responses, e.g., Cause: Inadequate cyber
security measues. Event: Cyber attack. Effect: Data breach, loss of
information, financial loss, reputational damage.
 Brainstorming and other group techniques: perhaps in team
meetings
Gathering a group of people to generate ideas and/or identify potential
risks and opportunities in a collobarative and structured manner
facilitates communication, collaboration and provide a comprehensive
assessment and analyses technique.
 Questionnaires
This technique involves sending surveys to the relevant stakeholders
which results in a gathering of information about potential risks and their
likelihood/impact.
 Individual interviews
A one-to-one conversation/interview with a stakeholder gathers details
information about potential risks. This helps identify their impact and
potentially identify risks that were not apparent.
 Assumption analysis: Reviewing the assumptions that you have made
Identify and challenge assumptions concerning a project or situation.
This aids the surfacing of hidden or overlooked risks and develop an
appropriate risk response.
 Constraint’s analysis: Reviewing the limiting factors on your service
This involves identifying the restrictions or limitations that may impact a
project or situation. This helps identify potential risks associated with
those constraints and develop an informed risk response.

When describing a risk it is important that it can be easily understood. The risk
description should consist of the cause, event and effect. This information
should be logged onto the council’s risk register (4Risk).

Risk Cause:
 What would cause the risk to happen, e.g., a fire, loss of key personnel.
This is where we consider what we could have done to prevent it.
Risk Event:
 What could go wrong. This is an uncertain event which may or may not
 materialise, that if it does would most likely have an impact.
Risk Effect:
 This is the potential outcome of the event, the consequence.

The risk description/statement could then be written as …

 “Because of (Risk Cause), (Risk Event) may occur, which would lead to
(Risk Effect).

As mentioned above the HDC holds its own risk register on 4Risk, which can
be found on the intranet. Staff should use 4Risk to track, update, add and review
risks.

HDC holds a single risk register which maintains risks across all levels of the
organisation including Corporate and Operational level risks. Corporate risks
are likely to affect the medium to longer term priorities and objectives of the
Council and require longer term planning to be addressed. Operational risks
tend to be related to ongoing service activities and have a more immediate
impact and generally need to be treated on a shorter time frame. By having a
single risk register, risks are collectively reviewed and mitigating actions applied
consistently. There is also less likelihood of duplication of risks e.g., budget
affordability can be included as a risk across all areas of the Council, rather
than each service registering this as a risk.

In addition to risk descriptions, it is important to capture the risk under the

relevant risk category (See step 2, Evaluate). This is because risks are unlikely
to remain static and they are required to be reviewed regularly to reflect
changing internal and external circumstances. Such reviews may lead to risks
moving between registers, new risks being identified, risk being closed when
appropriate and control measures being updated leading to changing residual
risk scores.

2. Evaluate

Once a risk has been identified, we need to assess how big a risk it is; how
much of an impact would it have, and how likely is to happen? Once we have
prioritised the risks, we must look in more detail at the risk to understand the
balance of threats and opportunities presented.

Estimation Techniques:
 Probability/Likelihood assessment: How likely is the risk to happen?
This technique involves assigning a value to the likelihood of a risk
occurring, which aids the prioratisation of risks.
 Impact assessment: What impact would it have were it to happen?
This technique involves assigning a value to the impact a risk will have
on the organisation and/or relevant department, which aids the
prioratisation of risks.
 Proximity assessment: How close (time) is it to happening?
 Assessing the potential timing of a risk (when it is likely to occur and how
long it may last) helps to make informed risk responses and create any
possible mitigation strategies.
- Expected value assessment
Calculating the expected value of a risk using its potential likelihood and
impact provides a quantitative measure of the potential cost of a risk and
helps to prioratise risk responses.

Evaluation Techniques:
- Summary risk profiles
By summarising the risks associated with a project/programme in a
concise and accessible format, you can see a high level overview of the
most critical risks which aids decision making.
- Summary expected value assessment
By calculating the expected value of multiple risks and summarising
them in a clear and concise way decision making and the understanding
of the overall risk profile of a project or situation is made easier.
- Probability trees
This technique uses graphical representation of risks and their potential
outcome, allowing a better understanding of complex risks and their
impacts.
- Sensitivity analysis
This involves assessing the impact of changes in assumptions or inputs
on the potential outcomes of a project/programme/situation. This helps
decision makers understand the potential risks associated with different
scenarios and adjust risk responses accordingly.
 Risk Categories

Risk categories are classifications of which business activity the risk relates to
and aids discussion on linked risks and mitigation. The categories below strike
the balance between completeness, focus on HDC’s risk profile, and usability
by end users. The risk category needs to be input into the risk register when
the risk is added.

Risk Categories Definition Trigger Questions

(Please note: This is not an exhaustive list
and should be used to help think of other
risks across all levels)

People Risks arising from staff related  Do you have a robust staffing structure?
matters, including culture,  Are you able to recruit when need to?
capacity, knowledge and  Do you have a risk or staff retiring or
capability, and non-compliance leaving?
with relevant employment  Are your team appropriately trained?
legislation/HR policies resulting  Do you have key responsibilities that rely
in negative impact on on a single individual?
performance.  Are staff aware of their point of contact
and the order of communication for
when decisions needs to be made?
 Do our operating processes carry any
risks to staff or the public?
 How will changes in legislation impact
upon our people?
 Are any changes to service delivery
planned, what will this affect?
 What dependencies do you have on
other teams, how would disruption there
impact your service?
Financial and Resources Risks relating to financial  Do you have a savings or income target
planning, financial control, and for the coming year?
insurance arrangements.  Do you have plans in place?
 Are you expecting any changes in terms
of demand, or fluctuation in your costs
that you need to plan for?
 Do you have adequate insurance cover?
 Are you aware of all opportunities for
income, funding and grants?
 Does a planned capital investment
require an ongoing revenue budget to
support it?
 Are external factors likely to impact upon
your service affordability, e.g., inflation?
 Will new activities require increased
support costs, e.g., reporting and
monitoring associated with external
funding?
 Will future funding changes impact your
service?
Operating Environment Risks relating matters which  What changes are happening, or are
affect or impact the daily, there possible signs of happening which
operating environment. Such as may affect the demand for, or the way in
Economic and Conmercial, which your service operates?
Social, Physical and Think in terms of…
Environemantal risks.  Competition from other organisations
 Social changes in terms of behaviours,
need and demand or the profile of your
customers?Are there economic changes
which could change services people
need, or change your ability to buy or
sell things. How could environmental
changes such as hotter summers, or
wetter winters affect your services. What
impact would inflation or increases in
borrowing costs have on your service?
 Who are your third party suppliers, what
happens if one of these fail?
 What happens if one of your
dependencies changes?
 Will future legislation require changes to
the Operatng Environment?
Policy and Process Risks relating to the  Do you have an understanding of the
management, organisation and policy environment in which you are
understanding of all policies, operating?
regulations, and strategies and  Are there any forthcoming policy
the relevant processes for the changes or emerging political priorities?
services you are responsible for.  Is the prioritisation of this activity
Including at national, local and appropriate in your service plan and/or
where relevant international approved with your manager and
levels. portfolio holder?
 Are you anticipating legislative or other
political changes either locally or
nationally to affect your service.

Legal and Contractual Risks stemming from legal and  Do you have contracts expiring in the
contractual obligations, next 2 years?
challenges and the management  Do you have plans in place?
of contracts and legal  Are you actively managing contracts,
documents. and escalating any issues?
 Income generation, are you able to
deliver all the services detailed in the
Service Level Agreement?
 Supplier agreements - Do you have an
up to date register of change controls
and impacts, have they been
implemented?
 Have you factored in contract
dependencies, e.g., agreed price
increases and know what the impact to
your budget is?
 Are you aware of contract break clauses
and the impact of these?
 Will a service transfer have TUPE
implications

Customer and Reputational Risks which are associated with  Do you have clear cost-effective
the failure to meet the current processes that enable you to deliver
and changing needs and services to your customers?
 expectations of the customer and  Do you have documented processes?
residents (Reputational risk).  Do you know the cost of your processes,
These risks may be associated and are you able to identify opportunities
with the processes you use to for improvement?
manage the work you deliver to  Do you have clear performance metrics,
your customers. and do you understand how effectively
your services are meeting customer
needs?
 Do you understand your Service Level
Agreement?
 Are your customers financially stable?
 Are these services we are permitted to
deliver/charge for?
Information and Technology Risks relating to the systems and  Do you understand and have developed
technology you use to deliver plans for all the technology that you use
your services – software, in your service?
appliances, phones, etc. As well  Do you have a list of all the systems,
as matters relating to the way in technology and software that your team
which you manage information, uses?
particularly relating to sensitive  Do you have system owners,
and personal information. champions, to maximise the benefits of
the systems?
 Do you have an information governance
lead?
 Do you have information management
plans for all of the data you hold, and
data sharing arrangements you have in
place?
 Will a process change require additional
software licences?
 Are you a data processor or controller,
how does this impact your data storage
and use?
 How will software updates impact your
service, risk of unforeseen downtime?
 Do you know how long you should keep
data for? Can you achieve this?

3. Planning

Following the evaluation step, it is time to prepare specific management

responses to the threats and opportunities identified (technically known as risk
treatments). This allows for effective decision making and enables effective
communication of risks and what you are doing to manage these.

This involves balancing the potential benefits of mitigating the risk – in terms of
improved delivery, with the cost of doing so. The cost is not just an economic
one, and needs to be reviewed against the objectives of the organsiation as
whole, e.g., broader economic, social, and environmental impacts. The delivery
of some activity is so important, that even expensive mitigation activity may be
welcome.

As part of the selection and development of risk treatments, we need to specify

how the chosen option(s) will be implemented, so that arrangements are
understood by those involved and effectiveness can be monitored. This should
include:
  the rationale for selection of the option(s) (why it was chosen),
including the expected benefits to be gained or downsides to be
avoided;
 the proposed actions (what we are going to do);
 those accountable and responsible for approving and implementing the
option(s) (who is going to do it);
 the resources required, including contingencies (the cost of doing it);
 the key performance measures and control indicators, including early
warning indicators (how we will know if it is working);
 the constraints (what will limit or stop us managing the risk);
 when action(s) are expected to be undertaken and completed; and• the
basis for routine reporting and monitoring (when will it happen).

Planning techniques:
 Risk response planning: what can we do?: avoid, reduce,
transfer/share, accept
o Avoiding the risk, if feasible, by deciding not to start or continue
with the activity that gives rise to the risk;
o Reducing the risk or changing the likelihood, where possible or
changing the consequences, including planning contingency
activities;
o Sharing the risk (e.g. through commercial contracts[12]).
o Retaining (accepting) the risk by informed decision or taking or
increasing the risk in order to pursue an opportunity;
 Cost benefit analysis: what is the cost vs the benefit, is the risk
avoidance work worth doing?
o This technique involves weighing the potential costs of risk
responses against their potential benefits. This aids the
identification of the most effective risk response and ensures risk
management efforts are cost effective.
 Decision trees
o This involves a graphical representation of decisions and their
potential outcomes to aid decision making with understanding the
potential risks associated with different options.
 Risk register details: risk owner, risk actionees, risk register, risk
response
o By maintaining a detailed record of identified risks and their details
(such as associated risk responses, descriptions etc) a central
information point for risk is there to inform decision making and
track risk management efforts over time.

4. Implementation
Once the risk management plan has been made it must be implemented,
monitored for effectiveness and corrective action taken when and where
needed. These implementation steps should generally feature in your service
plan, or within your project plan, so they can be reviewed and monitored.
Implementation techniques:
- Updated risk summary profile / risk register information
This technique involves regularly reviewing and updating the summary
risk profile to ensure changes are reflected, which ensures that the risk
management plan remains relevant and effective.
- Risk exposure trends
This involves tracking and analysing trends in risk exposure over time.
This helps to identify emerging risks and opportunities and inform
adjustments to risk responses and risk management strategies, if
needed.
- Risk progress report
By regularly reporting on the progress of risk management efforts,
including the status of risk responses and any changes to the risk
landscape, this ensures risk management efforts remain on track and
effective.

5. Embedding and Reviewing

Once an approach and process has been put in place it is essential to continue
applying it across the organisation and that it undergoes continual
improvement.

This includes understanding:

- Council’s Risk Appetite and Capacity.
- The Risk Strategy and Process.
- Benefits of risk management.
- Regular assurance reports.
- Lessons Learned.
- Risk priorities.
- Third parties to have adequate risk management skills and processes.

Developing and Integrating Risk Management

It is worth noting that the process of identification and management of risks
needs to be undertaken at all stages of the process at both corporate and at
service planning level. This ensures that the risk register contains all the
relevant details, changes and significant risks that would affect the achievement
of the Council’s objectives and priorities. This is achieved by describing the
impact of what is being considered on the Council’s priorities and targets and
be supported by the explicit consideration of the risks that are both inherent and
mitigated to the impact being achieved.

The table below explains how risk management processes link into the
Council’s planning process.
Risk Assessment
The risk assessment model is detailed in Appendix A3. The model requires
potential risks to be evaluated against a set of pre-determined criteria for
likelihood/frequency and impact at both the inherent (without controls) and
residual (with controls) risk levels. Individual risk levels are determined by
plotting the risks onto a risk matrix. Health and Safety risks will be plotted
against the smaller inset matrix.

Almost
ue
nc
d/
lih

eq
ke

Fr
Li

5 Medium High Very High Very High Very High

o
o

Certain

3Appendix A Link: Takes you to the section in the document which shows HDC’s Risk
Assessment Model.
 Likely 4 Medium High High Very High Very High

Occasional 3 Low Medium High High Very High

Unlikely 2 Low Low Medium High High

Improbable 1 Low Low Medium High High

1 2 3 4 5
Trivial Minor Significant Major Critical
Impact
Risk Appetite

The Cabinet shall determine the Council’s risk appetite; that is the amount of
risk it is prepared to accept, tolerate, or be exposed to at any point in time before
taking any action.

The Council’s appetite for risk will be considered as ‘exceeded’ when the
residual risk score (the likelihood and impact of threats after mitigations put in
place) have a score of 15 or above in accordance with the Council’s risk scoring
matri, as seen above.)

Where the risk appetite is exceeded in a particular service, services will be

asked to review the risk and identify any actions to treat the risk. Where the risk
tolerance is exceeded services will be asked to produce a risk treatment plan
on a template and to report this back to Assurance Board, to show the
quantification of the current risk and the proposed actions in response. If the
Assurance Board is satisfied the action plan will reduce the risk to be within risk
tolerance levels, the action is accepted and the risk will be returned to the
service for monitoring in the usual way.

If the risk remains outside of tolerance, or the Assurance Board does not believe
the proposed action plan sufficiently mitigates the risk, it will escalate the risk to
the Senior Leadership Team, and the respective manager who owns the risk
will be asked to follow the Options Appraisal and Risk Treatment process.

(Appendix B for options Appraisal and Appendix C for risk appetite exceeded
diagram).

Option Appraisals & Risk Treatment

For all individual residual risks that exceed their risk area targets as described
above, consideration shall be given as to what further cost-effective mitigation
could be introduced to reduce the residual risk score so that it falls within its risk
appetite.

Before a decision is made on the way the risk is to be treated, the respective
risk manager, who owns the risk, shall carry out an option appraisal (Appendix
B). The appraisal shall consider how to deal with the risk on the following basis:
  Reduce or treat the risk by controlling the likelihood of the risk
occurring or controlling the impact of the consequences if the risk does
occur.

 Avoid or eliminate the risk by not undertaking the activity that may
trigger the risk.

 Transfer the risk either totally or in part to others e.g. through

insurance.

 Accept or tolerate the risk. This option will only be accepted when the
ability to take effective action against a risk is limited or the cost of
taking action is disproportionate to the potential benefits gained.

The appraisal will consider cost, resources, time and the potential financial and
non-financial benefits of each treatment option. Advice from specialist staff such
as the Risk and Controls team members shall be taken where appropriate.

Ideally risk treatments should be self-funding. Where this is not the case there
will need to be a prioritisation process to ensure that any funding is
concentrated first on those items that will be most beneficial to the achievement
of the Council’s priorities.

 Action Plans

The results of the option appraisal shall be recorded by the risk owner on a risk
treatment option form (Appendix B) within four weeks of the risk having been
recorded in the risk register. The form shall identify the risk, the current control
environment, control actions to be introduced, the Officer responsible and the
timescales for implementation.

The risk owner shall send the option appraisal form to the Senior Leadership
Team Member for the service within six weeks of the risk being recorded in the
risk register. They will review and challenge the form. The form shall be
updated if required and then considered by the Senior Leadership Team who
will determine if the mitigation outlined is to be introduced. If the additional
mitigation cannot be met from the current Service budget the matter shall be
reported to the Cabinet for a decision. If further mitigation is agreed, the risk
owner shall update the risk register and put in place procedures to introduce
the agreed mitigation.

Roles and Responsibilities

Everyone in the Council is involved in risk management and should be aware
of their responsibilities in identifying and managing risk.

Council, Cabinet, Committees & Panels

 To ensure they consider risk management implications when making
decisions.
Cabinet
 To be responsible for ensuring effective risk management procedures
are in place across the Council and approving the risk management
strategy.
 To determine the Council’s risk appetite annually and review the risk
assessment model to ensure it continues to reflect the requirements of
the Council.
 To decide upon the action to be taken for all mitigated risks that exceed
the Council’s risk appetite or have the potential to harm its reputation or
the continuity of services and require additional budget expenditure that
cannot be funded from existing Service budgets.

Corporate Governance Committee

 To receive regular updates on risk management and consider any
governance issues arising.

Corporate LeadershipTeam
 To ensure effective risk management throughout the Council in
accordance with the risk management strategy.
 To make recommendations at least once a year to the Cabinet on the
Council’s risk appetite.
 To ensure that Members are advised of the risk management
implications of decisions.
 To review and challenge Corporate risk register entries at least once
every three months.
 To prioritise risk treatments and requests for additional funding.

Senior LeadershipTeam
 To develop a culture of risk management throughout the Council.
 Balancing an acceptable level of risk (as described by the risk appetites)
against the achievement of corporate and/or service plans, project
objectives and business opportunities.
 To identify and resolve any risks associated with compliance with the
Council’s agreed rules, procedures and processes.
 Ensure that risks relating to significant partnerships are identified and
effectively managed, within the partnership and at service level.
 To review and challenge Operational risk register entries at least once
every three months.
 To review and challenge risk treatment option forms submitted by the
Management Team and passing them onto the Corporate Management
Team if additional control measures cannot be funded from Service
budgets.

Management Team
 Ensuring that effective control procedures are in place to manage the
risks affecting their services.
 Review (as risk owner) their Corporate and Operational risk register
entries at least once every three months, reporting all new risks or
 significant changes to risk entries to their Head of Service and/or
Director.
 Maintain all risk register entries fully, updating them promptly with any
perceived new risks or opportunities, failures of existing control
measures and closing them when appropriate.
 Update at least once every six months risk register assurance
statements that describe the effectiveness of the risk mitigating controls.
 Prepare (as risk owner) for risks that exceed risk appetite levels, risk
treatment option forms for consideration by the Senior Management
Team.

Risk Officer, in collaboration with Assurance Board

 To assist managers in identifying and analysing the risks that they
encounter and the formation of action plans to address outstanding
issues.
 To provide assurance on the operation of the Risk Management process
and framework.
 To provide advice and guidance on systems to mitigate risk.

Assurance Board
 To report as necessary to the Cabinet, Corporate GovernanceCommittee
or Corporate Leadership Team on risk management issues.
 To identify best practice and consider its introduction within the Council.
 To provide advice and guidance on systems to mitigate risk.
 Ensure risk strategy is reviewed and updated annually/as needed.

Health and Safety

 All Elected Members and employees are responsible for taking care of
their own and their colleagues/visitors health and safety at all times. They
are responsible for the identification and treatment of hazards as
described in the Health and Safety Policy – Organisation &
Responsibilities.
 To work proactively with services across the Council, providing advice
on safe working practices to mitigate incidents, and monitoring
compliance with existing Health and Safety controls.

Internal Audit:

 Internal Audit will seek assurance from the risk register that the
organisation is assessing its risks on a regular basis and acting in a
responsible manner to mitigate them.
 It will use the risk register as a basis for informing the annual Internal
Audit plan, assessing if risks are correctly recorded and the mitigating
actions appropriately deployed and reported.
 It will escalate risks to Assurance Board where mitigating controls are
not deployed and the risk should be noted as unmitigated.
Employees
 To co-operate with management and colleagues in matters relating to
the mitigation of risk.
 To promptly inform the appropriate manager of any risks they become
aware of.
 Appendix A
Risk Assessment Model
appendix

Likelihood / Frequency
Alternatively this could be
expressed as likely to
happen within the next:

5 = Almost Certain Will definitely occur, possibly frequently. Month

4 = Likely Is likely to occur, but not persistently. Year

3 = Occasional May occur only occasionally. 3 years

Do not expect it to happen but it is
2 = Unlikely 10 years
possible.

Can’t believe that this will ever happen,

1 = Improbable 20 years
but it may occur in exceptional
circumstances.

When considering Health & Safety related risks, the likelihood should be
expressed as being likely to happen within the next:

4 = Likely Monthly
Further advice on assessing Health & Safety
3 = Occasional Yearly risks can be obtained from the Health & Safety
Manager
2 = Unlikely 5 years

Impact
Risks will be evaluated against the following scale. If a risk meets conditions for
more than one category, a judgement will need to be made as to which level is
the most appropriate. For example, if a particular health and safety risk was
significant, could result in minor short-term adverse publicity in the local media
but had only a trivial financial impact, it might still be categorised as significant.

1 = Trivial event or loss, which is likely to:

 cause minor disruption to service delivery on one or two consecutive
days, not noticeable to customers
 increase the Council’s net cost over the 5 year medium term financial
strategy (MTFS) period by £50,000 or less.
 be managed with no reporting in the local media
 cause localised (one or two streets) environmental or social impact

2 = Minor event or loss, which is likely to:

 cause minor, noticeable disruption to service delivery on one or two
consecutive days
 increase the Council’s net cost over the 5 year MTFS period by more
than £50,000 but less than £100,000.
 result in minor short-term (up to a fortnight) adverse publicity in the local
media
 Appendix A
Risk Assessment Model
 * be a Health and Safety (H&S) concern that results in an injury but 7
days or less off work
 have a short term effect on the environment i.e. noise, fumes, odour,
dust emissions etc., but with no lasting detrimental impact

3 = Significant event or loss, which is likely to:

 cause disruption for between one and four weeks to the delivery of a
specific service which can be managed under normal circumstances
 affect service delivery in the longer term
 increase the Council’s net cost over the 5 year MTFS period by more
than £100,000 but less than £250,000.
 result in significant adverse publicity in the national or local media
 * be a Health and Safety concern that results in more than 7 days off
work or is a specified injury, dangerous occurrence or disease that is
required to be reported to the H&S Executive in accordance with
‘Reporting of Injuries, Diseases and Dangerous Occurrences
Regulations 2013’ (RIDDOR)
 has a short term local effect on the environment, or a social impact, that
requires remedial action.

4 = Major event or loss, which is likely to:

 have an immediate impact on the majority of services provided or a
specific service within one area, so that it requires Managing Director
involvement.
 increase the Council’s net cost over the 5 year MTFS period by more
than £250,000 but less than £500,000.
 raise concerns about the corporate governance of the authority and / or
the achievement of the Corporate Plan
 cause sustained adverse publicity in the national media
 significantly affect the local reputation of the Council both in the long
and short term
 * results in the fatality of an employee or any other person
 have a long term detrimental environmental or social impact e.g. chronic
and / or significant discharge of pollutant

5 = Critical event or loss, which is likely to:

 have an immediate impact on the Council’s established routines and its
ability to provide any services, and cause a total shutdown of operations.
 increase the Council’s net cost over the 5 year MTFS period by more
than £500,000.
 have an adverse impact on the national reputation of the Council both in
the long and short term
 have a detrimental impact on the environment and the community in the
long term e.g. catastrophic and / or extensive discharge of persistent
hazardous pollutant
 Appendix B
Risk Treatment Option Form
Risk Treatment – Action Plan
Risk Current residual risk score:
Description of risk from register:
ID No: Likelihood x Impact

Controls already in place as listed on the risk register:

Are these controls operating effectively? Yes / No

Risk Action Plan (All actions listed in priority order)
New
residual risk Extra
score4 resources
required5
Proposed actions to reduce risk using existing resources L I

a.
b.
c.
Actions requiring additional resources

1.
2.
3.
4.
Decision
Agreed Option:
Implementation Date Risk Owner

Decision taken by: on:

Note: Health & Safety risks that exceeed their risk appetite shall be treated with counter-
measures or be stopped immediately until the residual risk has been sufficiently reduced. The
action that must be taken is set-out below and mirrors the approach set-out in the Council’s
approved Health & Safety risk assessment form.

4New Residual Risk Score: after the action has been introduced
5Extra Resources: only complete if extra resources will be required to allow the proposed action to be introduced
e.g. financial costs and staff time
 Remember, when considering treatment options that the Council’s aim is to
manage risk rather than eliminate it completely – successful risk management
is about improving risk taking activities whilst minimising the frequency of the
event occurring.

Issues that should be considered when making the risk treatment decision are listed
below.

Administration Is the option easy to implement?

Will the option be neglected because it is difficult to implement?
Do staff have sufficient expertise to introduce the option?
Continuity of effects Will the effects of the risk treatment option be long term/continuous or
short term?
If short term, when will further risk treatments be needed?
Does the risk need to be treated at all as it will ‘disappear’ in the short
term (e.g. a project it refers to will be completed or in the next three
months

Cost effectiveness Costs need to be estimated accurately as it’s the base against which
cost effectiveness is measured.

Can the cost of implementing further control be justified compared to the

risk reduction benefits expected?
What financial loss is to be expected if no action is taken?
Could the same results be achieved at lower cost by other means?

Will running costs go up or down?

What capital investment will be needed?
What other costs will there be?

Benefits What will happen to service levels?

What will happen to service quality?
What additional benefits or risk reductions will occur in other areas?
Can other controls in place be amended to deal with this risk?
How will you evaluate this option to see if it is reducing the identified
risk?

Objectives Will reducing risk advance the Council’s overall objectives?

What will be the economic and social impacts?
What will be the impact on the environment of leaving the risk as it is?

Regulatory Complying with laws and regulations in not an option.

Does the lack of treating the risk (or the current method of control)
breach any laws or regulatory requirement?
Is the treatment option proposed, including its cost, totally
disproportionate to the risk?

Risk creation What new risks will be created from introducing the option?
 Appendix C

Risk Appetite Exceeded Diagram

1. Residual risk score (the likelihood and impact of threats after mitigations are put in place,
score calculated using the risk matrix) exceeds the risk appetite (the maximum residual
risk an organisation will accept after controls are put in place in order to achieve its
objectives).
2. Service to review the risk and identify any actions to treat the risk.
3. If risk tolerance (the maximum risk the organisation is willing to take regarding a specific
initiative) is exceeded, the service will be asked to produce a risk treatment plan on a
template and to report back to the Assurance Board to show the quantification of the
current risk and the proposed actions in response to it.
4. If the Assurance Board is satisfied the action plan will reduce the risk to be within risk
tolerance levels, the action is accepted and the risk will be returned to the service for
monitoring in the usual way.
5. If the risk remains outside of the risk tolerance, or the Assurance Board does not believe
the proposed action plan sufficiently mitigates the risk, it will escalate the risk to the
Senior Leadership Team, and the respective manager who owns the risk will be asked to
follow the Options Appraisal and Risk Treatment process.
 Glossary
Risk appetite: The amount of risk the organization, or subset of it, is willing to
accept.
Risk capacity: The maximum amount of risk that an organization, or subset
of it, can bear, linked to factors such as its reputation, capital, assets, and
ability to raise additional funds.
Risk tolerance: The threshold levels of risk exposure that, with appropriate
approvals, can be exceeded, but which when exceeded will trigger some form
of response (e.g. reporting the situation to senior management for action).