Audit & Governance Committee

12 September 2023

Report of the Chief Finance Officer

Monitor 1 2023/24 - Key Corporate Risks

Summary

1. The purpose of this paper is to present Audit & Governance Committee (A&G) with an update on the key corporate risks (KCRs) for City of York Council (CYC), which is included at Annex A.

Background

2. The role of A&G in relation to risk management covers three major areas;

· Assurance over the governance of risk, including leadership, integration of risk management into wider governance arrangements and the top level ownership and accountability for risk

· Keeping up to date with the risk profile and effectiveness of risk management actions; and

· Monitoring the effectiveness of risk management arrangements and supporting the development and embedding of good practice in risk management

3. Risks are usually identified in three ways at the Council;

· A risk identification workshop to initiate and/or develop and refresh a risk register. The risks are continually reviewed through directorate management teams (DMT) sessions.

· Risks are raised or escalated on an ad-hoc basis by any employee

· Risks are identified at DMT meetings

4. Due to the diversity of services provided, the risks faced by the authority are many and varied. The Council is unable to manage all risks at a corporate level and so the main focus is on the significant risks to the council’s objectives, known as the key corporate risks (KCRs).

5. The corporate risk register is held on a system called Magique. The non KCR risks are specific to the directorates and consist of both strategic and operational risk. Operational risks are those which affect day to day operations and underpin the directorate risk register. All operational risk owners are required to inform the risk officer of any updates.

6. In addition to the current KCRs, in line with the policy, risks identified by any of the Directorates can be escalated to Council Management Team (CMT) for consideration as to whether they should be included as a KCR. KCRs are reported and discussed quarterly with CMT and Portfolio Holders.

Key Corporate Risk (KCR) update

7. There are currently 12 KCRs which are included at Annex A in further detail, alongside progress to addressing the risks.

8. Annex B is a one page summary of all the KCR’s and their current gross and net risk ratings.

9. In summary the key risks to the Council are:

· KCR1 – Financial Pressures: The Council’s increasing collaboration with partnership organisations and ongoing government funding cuts will continue to have an impact on Council services.

· KCR2 – Governance: Failure to ensure key governance frameworks are fit for purpose.

· KCR3 – Effective and Strong Partnership: Failure to ensure governance and monitoring frameworks of partnership arrangements are fit for purpose to effectively deliver outcomes.

· KCR4 – Changing Demographics: Inability to meet statutory deadlines due to changes in demographics.

· KCR5 – Safeguarding: A vulnerable child or adult with care and support needs is not protected from harm.

· KCR6 – Health and Wellbeing: Failure to protect the health of the local population from preventable health threats.

· KCR7 – Capital Programme: Failure to deliver the Capital Programme, which includes high profile projects.

· KCR8 - Local Plan: Failure to develop a Local Plan could result in York losing its power to make planning decisions and potential loss of funding.

· KCR9 – Communities: Failure to ensure we have resilient, cohesive, communities who are empowered and able to shape and deliver services.

· KCR10 – Workforce Capacity: Reduction in workforce/ capacity may lead to a risk in service delivery.

· KCR11 – External market conditions: Failure to deliver commissioned services due to external market conditions.

· KCR12 – Major Incidents: Failure to respond appropriately to major incidents.

10. Risks are scored at gross and net levels. The gross score assumes controls are in place such as minimum staffing levels or minimum statutory requirements. The net score will take into account any additional measures which are in place such as training or reporting. The risk scoring matrix is included at Annex C for reference.

11. The following matrix categorises the KCRs according to their net risk evaluation. To highlight changes in each during the last quarter, the number of risks as at the previous monitor are shown in brackets.

Impact
Critical
Major		1 (0)	5 (6)	1 (1)
Moderate		1 (1)	3 (3)	1 (1)
Minor
Insignificant
Likelihood	Remote	Unlikely	Possible	Probable	Highly Probable

12. By their very nature, the KCRs remain reasonably static with any movement generally being in further actions that are undertaken which strengthen the control of the risk further or any change in the risk score. In summary, key points to note are as follows;

· New Risks- No new KCRs have been added since the last monitor

· Increased Risks – No KCRs have increased their net risk score since the last monitor

· Removed Risks – No KCRs have been removed since the last monitor

· Reduced Risks – No KCRs have reduced their net risk score since the last monitor

Update on the Risk of Extreme Weather Events (KCR 12)

13. When the latest KCRs were discussed at the Executive/CMT briefing on 29 August, a request was made to consider the risk of ‘extreme weather events’ within the risk register. KCR12 Response to Major Incidents already contained reference to climate change and so the risk details have been revised with regard to extreme weather events and the likelihood of these increasing in frequency.

14. As a Local Authority, York continues to strengthen its climate resilience. According to the World Resource Institute [i], global temperatures have so far risen by 1.1°C, and already the planet has seen an increase in natural disasters such as flooding, hurricanes, and other extreme natural events. The 2022 IPCC Report [ii] warned that the world is set to reach above 1.5°C pre-industrial levels within the next two decades and stated only the most drastic cuts in carbon emissions would help prevent an environmental disaster.

15. In 2022 this prediction became a reality. York experienced the hottest day ever recorded at 38°C. This exceeded estimates for the hottest summer day of 35.6°C if global average temperatures increase 2°C above pre-industrial levels, demonstrating the urgency of action.

16. Across Yorkshire and Humber unprecedented summer heatwaves had temperatures rising above 40°C. During the heatwaves, the North Yorkshire Local Resilience Forum managed regional risks in line with multi-agency incident management and the council stood up silver command. Issues included fires in rural areas threatening isolated homes and farms, overhead electric cable disruption and road tarmac melting causing travel disruption. During the July 2022 heatwave, West Offices suffered an electrical malfunction from overheating causing the sprinklers to activate leading to additional disruption of council services.

17. Increased frequency of adverse weather events as a result of the changing climate brings multiple impacts that every council service will need to address. To prepare for increases in global temperatures and the impact it brings locally and to council services requires a shift in how the council responds, learning from the council’s well-rehearsed response to flooding, to prepare the city for adverse weather by putting in place controls to strengthen the city’s resilience.

Other updates to KCR risks, actions and controls

18. KCR 1 – Financial Pressures and KCR 7 - Capital Programme: a new action has been added to develop a budget strategy for 2024/25 with a target date of 31 January 2024.

19. KCR 2 – Governance: Now that the action to finalise the member development and training programme has been completed, this has been added the list of controls.

20. KCR 4 – Changing Demographics: The action to establish an interim Financial Inclusion Strategy has been completed, as this was approved in March 2023. A new action has been assigned to prepare an Anti-Racism Action Plan, specific to York. The transition strategy action date has been revised as further consultation time was needed to develop a new strategy, instead of revising the previous version, as had been the intention.

21. KCR 5 – Safeguarding: Risk detail and associated controls have been added to this KCR to document the risk of a failed statutory inspection, both financially and reputationally to the Council. These mitigations were already established and therefore there is no change to the risk score.

22. KCR 8 – Local Plan; revised target dates have been set and an update has been made to the control regarding the progress in developing and adopting the local plan. A further update is expected on this KCR once the inspection report has been issued in Autumn 2023. A more detailed report will then come to a future meeting of this committee.

23. KCR 10 – Workforce/Capacity; this risk has been updated throughout to update references to Covid 19 that are no longer applicable. All ongoing actions have been reviewed and revised dates set. A new action regarding the 2023/24 pay award implications has been targeted for 31 December 2023.

24. KCR 11 – External market conditions; the ‘All Age Market Position Statement 2023-2025’ was completed in April 2023 and is now available on the Council’s website.

Options

25. Not applicable.

Council Plan 2019-2023

26. The effective consideration and management of risk within all of the council’s business processes helps support achieving all eight of the key outcomes identified in the Council Plan.

Implications

27. There are no further implications.

Risk Management

28. In compliance with the council’s Risk Management Strategy, there are no risks directly associated with the recommendations of this report. The activity resulting from this report will contribute to improving the council’s internal control environment.

Recommendations

29. Audit and Governance Committee are asked to:

(a) consider and comment on the key corporate risks included at Annex A, summarised at Annex B;

(b) provide feedback on any further information that they wish to see on future committee agendas.

Reason: To provide assurance that the authority is effectively understanding and managing its key risks.

Contact Details Authors:	Chief Officer Responsible for the report:
Helen Malam Principal Accountant (Corporate Finance) helen.malam@york.gov.uk Lisa Nyhan Corporate Risk and Insurance Manager lisa.nyhan@york.gov.uk	Debbie Mitchell Chief Finance Officer
	Report Approved ü	Date 30/8/23

Specialist Implications Officer(s) None
Wards Affected: All

Background Papers: None

Annexes:

A – Key Corporate Risk Register

B – Summary of Key Corporate Risks

C – Risk Scoring Matrix