512
The Committee considered a report which provided it with an overview of the
Council’s risk management activity which had been undertaken during the financial
year from 01 April 2024 to 31 March 2025.
Hayley McGrath, Corporate Governance Manager, attended the meeting to introduce
the report and assist the Committee with its enquires. An annual report was
presented to the Committee, followed by a 6-month interim update later in the
municipal year. Risk Management was one of the Council’s Key governance
processes, and sought to understand the areas of potential risk which the Council
may face in the future, and which had the capacity to affect the delivery of key
services. Strategic risks were considered as high-level risks over which the Council
potentially had little control, while operational risks, such as health and safety risks,
were managed by individual service areas. All identified risks were set against the
objectives of the organisation and were reviewed by the Council’s Senior Leadership
Board (SLB) on a monthly basis. A Risk Management Strategy set out how risks
were managed at a high organisational level, and was the responsibility of Cabinet.
The Leader of the Council was passionate that risks were appropriately managed.
The current Strategic Risk Register, together with a revised Risk Management
Strategy were before the Committee, and it was asked to approve these documents,
prior to their referral to Cabinet and then Full Council, as part of the Council’s Policy
Framework.
The report which was before the Committee also set out some of the work which had
been undertaken in relation to risk management over the preceding year. Although
the Council’s risk management processes had been in place for some time, it was
recognised that further work was required to determine how much risk the Council
was prepared to accept as an organisation, which was an area which had been
highlighted by the Committee in the past. Accordingly, work had been undertaken
earlier in the year, supported by Committee members, senior Councillors, SLB and
risk consultants to determine what the Council’s risk appetite was. The usual risk
categories, known as PESTLE categories (political, economic, social, technological
legal and environmental risks) had been considered and criteria had been set for the
level of risk the Council was prepared to accept for each of these categories. A Risk
Appetite Statement had been prepared which had been approved by the Council’s
Leadership, and was now used as part of all the Council’s risk documentation.
The attention of the Committee was drawn to the Strategic Risk Register which was
before it, and which set out key strategic risks, of which local government
reorganisation (LGR) was foremost. This risk was not only concerned with the final
position of Colchester City Council, but recognised some of the risks which were
being experienced already such as pressure on staff resources and morale, and
uncertainty for the future. Cyber security had also been identified as a key risk, which
was anticipated to become more serious in the future. The Corporate Governance
Manager had met with the Council’s Interim Head of Digital who was passionate
about cyber- security, and would be keen to attend a meeting of the Committee to
provide a presentation on this topic later in the municipal year, in a workshop
environment prior to a Committee meeting.
The Committee member considered that it was correct that the impact of LGR had
been recognised as such a significant risk, considering that local authorities relied on
Councillors and Officers to provide services to residents, and that the coming period
of uncertainty had to be recognised, and its effects mitigated affectively against. It
looked forward to hearing more about the work which had been undertaken in this
area as the municipal year progressed.
The Committee sought to understand how the impact of the work which had been
undertaken to understand the Council’s appetite for risk had been quantified; what
had been the cost of the risk consultant, and how had the decisions of Cabinet been
directly affected as a result of this work? The Corporate Governance Manager
confirmed that there had been no cost associated with the risk consultants, which
had been provided as part of the Council’s insurance programme, which provided
the Council a yearly budget to spend on risk work. Councillor King, Leader of the
Council and Portfolio Holder for Strategy, attended the meeting, and, with the
permission of the Chair, addressed the Committee. Welcoming the questioning and
challenge from the Committee, he considered that the Council’s Risk Register was a
spur to better decision making. Although a direct quantification of this impact was not
available, the Committee was offered assurances that although the Council would be
faced with difficult decision in the near future, it was aware of the risk assessments
which would inform those decisions.
Richard Block, Chief Operating Officer, attended the meeting and advised the
Committee that consideration was being given as to how to structure the Risk
Register to include risk appetite, enabling an explanation to be provided to the
Committee as to why the Council had accepted a particular level of risk. The
Corporate Governance Manager confirmed to the Committee that the Councils risk
appetite would be considered by Heads of Service when making operational
decisions or carrying out service reviews.
Considering the Risk Appetite Statement Development document which had been
presented to it, a Committee member noted that it asserted that elected Members
had a moderate appetite for risk, how could this be reconciled with external factors
which impacted the Council such as the reduction in the core grant which was
received from central government, together with the known reduction in business
rates income which would impact the Council in the future? There would be difficulty
in responding accurately to the risks inherent in this situation while the future was still
so uncertain. Anna D’Alessandro, Interim S151 Officer, advised the Committee that
this position was now a new one, and took place every year. Part of the problem
which local authorities faced, was that the terms of the provisional settlement from
central government were not always known until December, leaving a very short
period of time for Councils to close their budget gaps. It was necessary to prepare
for the uncertainty of both LGR and the imminent reduction in funding, and this work
would begin early. The Council had the benefit of reserves which it was able to use
strategically thanks to previous good decision making, and the Council’s ‘Fit for the
Future’ programme sought to mitigate this risk as much as possible. The Chief
Operating Officer confirmed that multi-year government finance settlements had
been promised, which would further assist with budget planning through the year.
A Committee member considered that in his experience there had been a reduction
in the risk appetite of Councillors, and where risk was accepted this had been in
relation to the necessity of service provision with reducing resources. It was
interesting to note from the Register that the score related to the risk of LGR had
remained very high at 20, even following mitigation. There was a danger that the
organisation fell into the trap of considering the deadline for LGR of 2028, and did
not consider beyond this point, whereas it was important to ensure that a working
Council remained in place after LGR to continue to deliver essential services to
residents. In response, the Leader of the Council recognised the duty on Members
and Officers to plan for the future in a structured way, and considered that there was
cause for some optimism, with opportunities to make improvements which would
impact the lives of thousands of residents.
Returning to the issue of cyber security, a member of the Committee sought
clarification on whether or not training was mandatory for all staff and Councillors in
relation to potential cyber security threats. The Corporate Governance Manager
confirmed that training was mandatory for all staff, and testing was carried out
throughout the year by way of phishing exercises. Training for Councillors was not
mandatory, however, it was understood that the Interim Head of Digital was keen that
this took place, and conversations with the Councils’ political group leaders was
planned on this topic, which met with the approval of the Committee.
A Committee member considered that the use of artificial intelligence (AI) by both
staff and Councillors should be given careful consideration, as the use of an external
AI for Council business could easily lead to data breaches. It was essential that this
was acknowledged internally, and staff and Councillors were offered advice setting
out what was, and what was not, acceptable use of AI services.
RESOLVED that:
- The Council’s progress and performance in managing risk during the period
from April 2024 to March 2025 be noted, and;
- the current strategic risk register be noted, and;
- the proposed risk management strategy for 2025/26 be noted, and;
- the submission of the Officer’s report to Cabinet to approve the risk
management strategy for 2025/26 be endorsed.