The report of the Risk Manager is to follow.

Contact: Jane Cooper 01743 252851

The Committee received the report of the Risk Management Officer – copy attached to the signed minutes – which provided an overview of the activity of the Risk, Insurance & Resilience Team during 2021/2022 and a synopsis of the current risk exposure of the authority in relation to Strategic, Operational and Project risks.

The Risk Management Officer introduced and amplified her report.  She reported that the Audit review of risk management this year had identified the assurance level as ‘Reasonable’ with actions required of service managers in relation to operational risk management.

The Risk Management Officer drew attention to the June 2022 review when there were 14 strategic risks on the Strategic Risk Register, set out in Appendix B, 10 of which were high, three medium, and one low. 

Turning to operational risks, these were now embedded into a SharePoint site and as such could be updated in real time.  There were currently 126 operational risk registers in place (compared to 128 last year) containing 1,385 risks in total (1299 last year), as set out in Appendix C.  The Risk Management Officer drew attention to the 954 project risks, set out in paragraph 8.3 and Appendix D of the report.

The Risk Management Officer highlighted the work undertaken in relation to Business Continuity Management, set out in Paragraph 9 of the report.  She reported that as part of the Business Continuity arrangements, a cyber incident preparedness business impact analysis was being developed and would result in an Action Plan to address any areas of concern.  It was hoped to hold the postponed inaugural Shropshire Resilience Conference in May 2023 to coincide with the national business continuity awareness week.

In response to a query about the continued high level of risk due to Covid, the Risk Management Officer explained that it was hoped to see this risk reduce by November and the Council have moved to the recovery phase and were getting back to business as usual and work that was delayed.

In response to a query the Risk Management Officer explained that the strategic risks were the high level risk exposure and there would be elements of all those strategic risks within some of the project risks and operational risks and from the November review they would be linking through the operational risks through to the strategic risks so it would be much clearer how those strategic risks were impacting operationally, but also at an operational level, what was being done to mitigate the strategic risk in that area as well.

The Risk Management Officer went on to explain that as part of the operational risk review, which was a month before the strategic risk review, any themes that were linked through to the strategic risks which were of a concern, would feed through to that, along with any emerging theme from the operational risk review that it was felt needed to be considered as a strategic risk in its own right would be raised with the Executive Director team for them to make that decision.  What they would also do, from some of the major projects would not just have a project risk register, they would have a strategic risk register as well which would sit over the top of that Project.  They also looked at the strategic high level risks to key programmes of work as well as part of that whole risk management process.

In response to a comment, it was agreed to include the direction of travel in Appendix C of the next report to Audit Committee so that Members could see how the operational risk exposure had altered from one period to the next.

RESOLVED:

To accept the position as set out in the report.