The report of the Head of Policy and Governance is attached.

Contact: Barry Hanson 07990 086409

The Committee received a report providing an update on corporate risk management arrangements, including the annual review of strategic, operational, and project risks, and proposals for a revised risk management framework.

The Head of Policy and Governance introduced the report and advised that it represented a fundamental reset of the council’s approach to risk management, reflecting previously identified weaknesses in the control environment and the need for stronger corporate assurance. It was reported that responsibility for risk management would transfer into the governance and legal function from October, creating closer alignment with internal audit. It was confirmed that internal audit assurance over risk management would remain independently reported to the Committee to preserve audit objectivity. It was further noted that an interim Risk Manager had been appointed to support implementation of the revised framework, with permanent recruitment planned later.

The Committee was informed that the Council currently had twelve strategic risks, alongside approximately eighty-two operational risk registers containing over one thousand individual risks, and a further six hundred and thirty-nine project risks. It was explained that these would be subject to a comprehensive review between October and December, with all operational and project risks being reassessed using an updated ten-by-ten scoring matrix. The outputs of this exercise would then inform a refreshed set of strategic risks, which would feed into the Annual Governance Statement process for the following year.

Members sought assurance on whether the revised approach would include retrospective learning from previous major projects and decisions, including transport infrastructure schemes and other significant capital programmes. In response, it was stated that the process would primarily be forward-looking, but that previously identified risks arising from past decisions would be reassessed and incorporated where relevant into the new risk profile. It was also acknowledged that certain historic decisions had created ongoing risk exposures which now required formal recognition within the risk framework.

Concerns were raised regarding whether the revised approach would be sufficiently independent and robust to challenge historical organisational decisions and whether it would have the capacity to address politically sensitive or complex legacy issues. It was confirmed that the methodology would be applied consistently across all risk areas, and that professional internal audit standards would ensure that significant issues identified through the process would be escalated appropriately.

The Committee discussed whether strategic risk ownership should sit at senior statutory officer level or be delegated to service directors. It was clarified that strategic risks would be owned at statutory officer level following recent workshops, while responsibility for implementing mitigating actions would remain with Service Directors and operational leadership.

Members questioned whether the current draft strategic risks were sufficiently developed to be formally endorsed. It was noted that the risks had been extracted from the Annual Governance Statement and were not yet fully re-scored under the new framework. Some members expressed concern that the risks remained too high level and insufficiently refined for formal approval. In response, it was explained that the document represented an interim position pending completion of the full risk review exercise, and that further refinement would occur following completion of the operational risk reassessment.

The Committee also explored how risk appetite would be defined and embedded within the organisation. It was explained that the revised framework would establish a clearer risk tolerance model, allowing risks to be assessed consistently against agreed organisational appetite once the full review had been completed. It was noted that this would support more consistent decision-making across services.

Further discussion took place regarding the proposed use of a ten-by-ten risk scoring matrix. Members sought clarification on whether this would improve the ability to differentiate between likelihood and impact and how consistency would be ensured across services. It was confirmed that the approach was widely used across the public sector and would provide greater granularity than the existing system.

Questions were raised about whether risk management would be integrated with emergency planning and business continuity arrangements, given the Council’s statutory responsibilities in relation to civil contingencies. It was confirmed that emergency planning and corporate risk management would continue to be closely aligned, and that integration with business continuity planning would form part of the revised framework.

Members also queried whether the volume of identified risks would be reduced and whether a clearer prioritisation approach would be introduced. It was explained that once the full review was completed, the intention would be to identify the highest priority risks, likely in the region of the top fifty to one hundred, which would form the basis of strategic oversight.

Assurance was sought on whether the revised framework would include mechanisms to ensure risks were not only recorded but actively managed with mitigation actions tracked to completion. It was confirmed that enhanced monitoring arrangements would be introduced, including clearer tracking of mitigation actions, ownership, and implementation timelines, with escalation routes where necessary.

RESOLVED:

to accept the report as an interim position and to note that the risk management framework was under development and that a further refined risk profile would be presented following completion of the full review cycle.