City of York Council (Logo)


Audit & Governance Committee

Meeting date:


Report of:

Debbie Mitchell, Chief Finance Officer

Portfolio of:

All Executive Members

Audit and Governance Committee Report:

Monitor 3 2023/24 – Key Corporate Risks

Subject of Report


1.           The purpose of this paper is to present Audit & Governance Committee (A&G) with an update on the key corporate risks (KCRs) for City of York Council (CYC), which is included at Annex A.


Policy Basis


2.           The effective consideration and management of risk within all of the council’s business processes helps support the administration’s key commitments and priorities as outlined in the Council Plan 2023-2027.


Recommendation and Reasons


3.           Audit and Governance Committee are asked to:

a)   consider and comment on the key corporate risks included at Annex A, summarised at Annex B; 

b)   provide feedback on any further information that they wish to see on future committee agendas

Reason: To provide assurance that the authority is effectively understanding and managing its key risks




4.           The role of A&G in relation to risk management covers three major areas;

·        Assurance over the governance of risk, including leadership, integration of risk management into wider governance arrangements and the top level ownership and accountability for risk

·        Keeping up to date with the risk profile and effectiveness of risk management actions; and

·        Monitoring the effectiveness of risk management arrangements and supporting the development and embedding of good practice in risk management


5.           Risks are usually identified in three ways at the Council;

·          A risk identification workshop to initiate and/or develop and refresh a risk register. The risks are continually reviewed through directorate management teams (DMT) sessions.

·          Risks are raised or escalated on an ad-hoc basis by any employee

·          Risks are identified at DMT meetings


6.           Due to the diversity of services provided, the risks faced by the authority are many and varied. The Council is unable to manage all risks at a corporate level and so the main focus is on the significant risks to the council’s objectives, known as the key corporate risks (KCRs).


7.           The corporate risk register is held on a system called Magique. The non KCR risks are specific to the directorates and consist of both strategic and operational risk. Operational risks are those which affect day to day operations and underpin the directorate risk register. All operational risk owners are required to inform the risk officer of any updates.


8.           In addition to the current KCRs, in line with the policy, risks identified by any of the Directorates can be escalated to Council Management Team (CMT) for consideration as to whether they should be included as a KCR. KCRs are reported and discussed quarterly with CMT and Portfolio Holders. 


Key Corporate Risk (KCR) update


9.           There are currently 12 KCRs which are included at Annex A in further detail, alongside progress to addressing the risks.


10.        Annex B is a one page summary of all the KCR’s and their current gross and net risk ratings.


11.        In summary the key risks to the Council are:


·        KCR1 – Financial Pressures: The Council’s increasing collaboration with partnership organisations and ongoing government funding cuts will continue to have an impact on Council services

·        KCR2 – Governance: Failure to ensure key governance frameworks are fit for purpose.

·        KCR3 – Effective and Strong Partnership: Failure to ensure governance and monitoring frameworks of partnership arrangements are fit for purpose to effectively deliver outcomes.

·        KCR4 – Changing Demographics: Inability to meet statutory deadlines due to changes in demographics

·        KCR5 – Safeguarding: A vulnerable child or adult with care and support needs is not protected from harm

·        KCR6 – Health and Wellbeing: Failure to protect the health of the local population from preventable health threats. 

·        KCR7 – Capital Programme: Failure to deliver the Capital Programme, which includes high profile projects

·        KCR8 - Local Plan: Failure to develop a Local Plan could result in York losing its power to make planning decisions and potential loss of funding

·        KCR9 – Communities: Failure to ensure we have resilient, cohesive, communities who are empowered and able to shape and deliver services.

·        KCR10 – Workforce Capacity: Reduction in workforce/ capacity may lead to a risk in service delivery.

·        KCR11 – External market conditions: Failure to deliver commissioned services due to external market conditions.

·        KCR12 – Major Incidents: Failure to respond appropriately to major incidents.


12.        Risks are scored at gross and net levels. The gross score assumes controls are in place such as minimum staffing levels or minimum statutory requirements. The net score will take into account any additional measures which are in place such as training or reporting. The risk scoring matrix is included at Annex C for reference.


13.        The following matrix categorises the KCRs according to their net risk evaluation. To highlight changes in each during the last quarter, the number of risks as at the previous monitor are shown in brackets.
















1 (1)

5 (5)

1 (1)




1 (1)

3 (3)

1 (1)



















Highly Probable


14.        By their very nature, the KCRs remain reasonably static with any movement generally being in further actions that are undertaken which strengthen the control of the risk further or any change in the risk score. In summary, key points to note are as follows; 


·        New Risks- No new KCRs have been added since the last monitor

·        Increased Risks – No KCRs have increased their net risk score since the last monitor

·        Removed Risks – No KCRs have been removed since the last monitor

·        Reduced Risks – No KCRs have reduced their net risk score since the last monitor

Updates to KCR risks, actions and controls


15.        KCR 2 – Governance: the ongoing action to embed the recommendations from the public interest report has been reviewed and the target date revised to the 31st March 2024.  This remains ongoing to ensure continued compliance with the relevant elements of the action plan.  The action regarding compliance with the Freedom of Information (FOI) action plan and dealing with the backlog of outstanding FOIs, has now been completed in line with the specified timescales.


16.        KCR 4 – Changing Demographics:  The action to develop a frailty hub has been completed; this is now operational with adult social care working with NHS and voluntary sector colleagues supporting early intervention and prevention to manage demand.  The action to produce an Anti-Racism Strategy has also been completed and was approved at Executive in December 2023.


17.        KCR 5 – Safeguarding: A revised date has been set for the action to recruit to a new support role in ASC.  Recruitment is underway and so the revised date for the end of February 2024 is set.


18.        KCR 6 - Health & Wellbeing:  A number of revisions have been made this time to the risk details, implications and controls in order to reflect the KCR in a post-covid world.


19.        KCR 8 – Local Plan: The Local Plan Inspectors report to Council had been expected early this year, however a further hearing has been requested which will delay the conclusion of their review.  Therefore, revised target action dates have been set to align with the progress being made to approve the local plan later this year.     Although expected to have been included on this agenda, a more detailed report will now come to a future meeting of this committee.


20.        KCR 9 – Communities: A revised date has been set to establish the new equalities and access team.  Although the action is in progress, in light of the CLG review a longer timeframe is required for this action.


21.        KCR 10 – Workforce/Capacity: The action on negotiating this year’s pay award has been completed.  All ongoing actions have been reviewed and revised dates set. 


22.        KCR 11 – External market conditions: a new action has been added to this risk relating to joint working with NHS colleagues.


23.        KCR 12 – Major Incidents – Revised dates for both actions have been set. We are still awaiting the legislation for Terrorism (Protection of Premises)/Martyn’s Law to be passed, which will present new obligations for the Council to meet.




Consultation Analysis


24.        Not applicable


Risks and Mitigations


25.        In compliance with the council’s Risk Management Strategy, there are no risks directly associated with the recommendations of this report.  The activity resulting from this report will contribute to improving the council’s internal control environment.


Contact details


For further information please contact the authors of this Report.





Helen Malam

Job Title:

Principal Accountant (Budget & Collection Fund)

Service Area:

Finance & Procurement


01904 551738

Report approved:




Background papers: None


Annex A: Key Corporate Risk Register

Annex B: Summary of Key Corporate Risks

Annex C: Risk Scoring Matrix