To consider the above report.

Councillor Saunders introduced the report and explained to the Panel that the report had been updated and the amendments to the report would be attached to the minutes.

The changes and amendments were as follows:

Ø  Paragraph 10.1 new appendices:

o   Appendix A1 – heat map showing current impact/probability assessments and headline of detail of the current key operational risks.

o   Appendix A2 – detail supporting the key strategic risks in appendix A.

Ø  Paragraph 11.5 added “… and appendix A1 covers the key operational risks. There are three new strategic risks presently awaiting full articulation covering:

o   Non-compliance with the EU’s General Data Protection Regulation.

o   Governance failure of joint owned companies e.g. Achieving for Children and Optalis.

o   Governance failure of contractual arrangements e.g. Volker Highways.”

Ø  Paragraph 11.6 was removed because it was now also dealt with by appendix A1.

Ø  Paragraph 11.8 now read: “The (then) CMT endorsed the risk appetite categories and bandings used in appendix B at their meeting 8 February 2012. These were first presented and endorsed by this Panel as part of the “Risk Management Policy and Strategy 2012/13” at their meeting 19 November 2012 and annually thereafter” – Councillor Saunders felt it was helpful to see a status report on things seen before and previously approved.

Ø  Paragraph 11.9 was new and read: “The risk register provides an alert system for missed risk owner reviews. A summary of these will now be presented by the risk and insurance manager to the head of finance and deputy director on a monthly basis. Cllr Saunders felt it was important that the process made explicitly clear what happened if risk owners had for whatever reason not on a timely basis updated the review of risks which they owned, what would happen.

Councillor Saunders stated that the report was intended to give an adequate degree of confidence that the processes which officers facilitate enabled the various key Members management and key Members of Cabinet to focus upon the key risks, be they strategic or operational, and for them to assess the nature of those risks to assess the level of risk which exists today with whatever controlled environment was in place today, to then consider whether first further risk mitigation was appropriate and what that might be; and therefore to seek to predict what the residual further managed risk is and whether the council should rationally and reasonably accept an appetite for that level of risk to simply remain and not be reduced all the way to zero. It is that process that is described in the report and its detailed appendices, and examples could be seen of where the products of that process come to be stacked. He added that risk owners were not in the room aside from Rob Stubbs, Deputy Director Place & Head of Finance, therefore any comments made regarding whether the risks had been assessed or mitigated appropriately or whether the risk appetite was judicious, any comment made would be second hand, speculative or here say, but they could be added to the agenda of the next meeting with the relevant risk owners invited to respond to queries and questions.

Councillor Saunders confirmed that the process arrived at an acceptable level of residual risk which was deemed to be appropriate to accept, i.e. the appetite existed, and that having accepted the appetite for risk, it must by definition only be accepted as was shown in the appendix if the risk owner believed that the relevant monitoring or further activity was adequate. Councillor Saunders explained that the adequacy of the monitoring of that unmitigated risk would not be part of the risk management process as that would be the responsibility of the relevant risk owner within their internal processes. Councillor Brimacombe responded it was a judgement call on the risk owner but, they needed to show they had gone through the process to get to that judgement and he wanted to see that. Councillor Saunders explained that there was a coherent risk management process, for example if in the safeguarding of children area, the effective management of cases, if thought to be an appetite that can be accommodated because there are sufficient resources, regular identification of case reviews and regular processes by which the individual risks associated with particular safeguarding cases are being managed, then there was not a need to increase the controls further by definition, the activities associated with that would then be managed by that team and the risk management process would have no further involvement.

Councillor Brimacombe stated if in that example, he was the person making that judgement, he felt there was a requirement to put in that report that the processes would include revisiting that judgement at a later date because otherwise, it was all a one-off moment and the overarching process would not know if it was ever to be revisited. He added he would prefer to include a six monthly check of judgements made on key risks. Councillor Saunders responded that the points raised by Councillor Brimacombe were embedded within the process; because the reassessment and reflection of the process and the sequences of checks and assessments to be made, was made clear in the amendments to the appendices as there ought to be a clear mechanism if a risk owner did not demonstrate that with an appropriate degree of frequency and diligence, that they were not rerunning that sequence therefore, reaffirming the judgements they had previously made six months earlier. Councillor Brimacombe commented he was happy there were mechanisms in place to intervene should it be required.

Councillor E. Wilson asked if there had been any incidents that needed to be reassessed. Steve Mappley, Insurance and Risk Manager confirmed there were no incidents and there had been very little movement in the last 12 months as very little had changed. Councillor E. Wilson requested confirmation that the organisation had had no incidents of risks. Councillor Saunders said incidents had occurred but, they would not change any risk assessments or the way in which risks were managed. He stated when looking at the current risk of homelessness, it was at 12 red and under review. Therefore, a reassessment would not change the rating, it would affirm it was still 12 red.

Councillor E. Wilson asked if there had been any incidents that had changed the controlled assessments. The Insurance and Risk Manager responded he would need to look at the controls. Councillor Saunders said he was concerned because the process should be yes, but the appropriate and specific risk owners needed to answer the question; any other answer would be speculation.

Councillor E. Wilson requested a sample of some risk incidents be added to the work programme moving forward and that risk owners attend the Panel to answer questions and queries over the course of the next 12 months. Councillor Saunders stated he hoped to provide sufficient information on areas Members wished to scrutinise further with the relevant risk owners. The Insurance and Risk Manager explained that column A2 shown on page five of the supplement appendix showed the changes made to individual risks in the last 12 months. He added if it was compared to the previous 12 months, he would expect to see some movement and changes.

The Insurance and Risk Manager stated the report showed the direction of travel of the assessments. Councillor Saunders clarified that no incidents occurred which changed any of the risk assessments presented in the report or in the updated appendices. He added he was aware of a significant incident where it showed as 12 red in the report. Would that change the assessment, no it would not, it would simply affirm it. Councillor E. Wilson responded querying if there had been any incidents in the last 12 months that had changed the controls of the assessment of the risks presented to Panel. Councillor Saunders confirmed Councillor E. Wilson would need to ask the relevant risk owner as it was a specific query. Councillor E. Wilson requested that individual risk owners be invited to Panel to discuss the individual risks they managed so that the Panel could get a greater understanding of the detail on the issue. Councillor Saunders stated he was able to provide sufficient information in the report for Members to be able to identify the areas which they might want to pursue further scrutiny. He stated he felt the report and its appendices had done that. Councillor E. Wilson said that while Councillor Saunders and the Insurance and Risk Manager did not own the risks, they did have a level of accountability towards the risks.

Councillor Saunders confirmed that any change in risk assessment or status fundamentally related to liquidity and legality. Liquidity in terms of cash and legality in terms of if there were still positive revenue reserves. He stated anyone with an accounting background would appreciate it was not a lack of profit that made companies go under but the lack of cash. So a company could be making losses but provided it had not got to the bottom of its reserves, what caused problems was if the company ran out of cash. In order to enhance those issues, what they had done over the last 12 months was in addition to the historic assessment of minimum reserve levels, which was a regulated process as part of the annual budget, members would have seen in the budget papers earlier in the beginning of 2018, a detailed assessment of what a minimum reserve should be in order to be able to avoid getting to the bottom of that and slipping into negative reserves. RBWM capacity in that regard left the borough in excess of £5m buffer of reserves. That situation had not substantially changed for a number of years. In order for the borough to cross that line and get the borough into difficulty, the Borough would have to incur substantial revenue shortfalls during the course of the year in order to accumulate an overall revenue shortfall in excess of £5m. In order to monitor that, there were monthly update reports which exposed where the Borough stood against that position. The Borough had historically always been on the right side of that £5m buffer and expected to end the year with an excess £1m above the minimum level. And that was how the Borough handled the risks of its revenue reserves running out.

Councillor Saunders stated that in terms of cash, the Borough had introduced over the last 12 months as part of the financial update report, flexed cash forecasting reporting for the ensuing 12 months and that was shown in a new appendix which had existed for 10 months where for every month, there was a review of what the expected cash forecast would be against the expected cash levels and expected borrowing levels. He stated the Council had quite deliberately over the last 12 months built in to the cash forecast a very full expectation of the net cash outflow that the council could have accumulated over the 12 months ending 31 March 2018. If Members followed the monthly reports, they will have noted the council ended the year with a relatively modest level of debt, substantially below the £79m that had been mentioned over the years, which was a deliberately prudent expectation. He did not expect to end 2019 with as much debt. Councillor Saunders explained to Members that he had published a detailed reconciliation of how the council went from a debt of £79m to £20m through spending less and delaying projects or switching those projects to something different but which gave the same results and all of the risks associated with that were transparent.

Councillor E. Wilson requested the risk owners responsible for education be invited to the next meeting. Councillor Saunders responded the culpability for education sat in a variety of different places. However, responsibility for education did sit within the Borough and how that culpability grey area needed to be answered by Councillor N. Airey and Kevin McDaniel, Director of Children’s Services. Councillor E. Wilson also requested Councillor Grey be invited to a future meeting to respond to queries on waste management. Councillor Saunders said the process judges culpability with the Council even though the Council commissioned services. The Borough needed to protect culpability.

Councillor D. Wilson thanked officers for providing the new appendices as they were useful and highlighted areas that Members might want to interrogate. He added that appendix A1 on key risks, the first one was the current risk rating if 12 referred to homelessness. As Members were aware, they had received a presentation on Universal Credit (UC) being rolled out in Maidenhead in May 2018; therefore, the Panel should request the attendance of Hilary Hall, Deputy Director Strategy and Commissioning Strategy and Commissioning at a future meeting as the roll out of UC could equate to quite a high risk element. It was important to try and look at that as individuals needed to complete UC forms that might not have the ability to do so and it could also take up to 10 weeks for claimants to receive payments. Councillor Saunders advised Members that it was up to the Audit and Performance Review Panel to investigate those matters. When the Panel invited relevant risk owners to attend, he suggested they made it known to the relevant Chairman of Overview and Scrutiny Panels so those Members could also join the meeting. He urged Members to take control of that so that those Chairman and Members of O&S Panels attended the Audit and Performance Review Panels so it could retain the risk focus and control.

Councillor D. Wilson selected appendix A2, where it stated the IT side of the business and out of hours support, he stated the Council was trying to encourage residents to use IT for reporting as much as possible but they often got frustrated when the system went down; the current risk rating was at 12 so he queried if it was a risk and if Russell O’Keefe, Executive Director Place Directorate was the appropriate head of service and if so, he should also be invited to attend a future meeting to discuss risks. Councillor Saunders responded it was a valid issue and the officer that was quoted in the appendix was the relevant director so, it was appropriate to invite them as well as the Lead Officer. He added that controls in that rating were expected to reduce from 12 to four.

Councillor L. Evans asked how the process dealt with risks such as GDPR. She stated currently the rating was at zero but that was very low. Councillor Saunders stated the process had picked up the need to focus on the risk but the detailed status was not yet available to report. GDPR was very straight forward and the only thing that needed to be understood was what was personal information, what was sensitive information and did the Council have permission to use that information. Councillor L. Evans commented the ICO stated on their website that  Members acting on behalf of residents taking on complaints needed to register with the ICO. Councillor Saunders responded that was not the case as long as within the communications email addresses were deleted. If the email had to be passed on to someone else, then permission was required.

Councillor Alexander queried if some of the detail of controlled measures would be subject to Part II as some of the information would be of a sensitive nature. Councillor Saunders confirmed information was not supposed to be put into Part I anything that a Member did not have permission for. If a Member controlled all of the information, they could judge whether the information could be made Part I or Part II. In response to questions on when Members would see details of the plan to consider before risk owners were invited to attend Panel, Councillor Saunders stated the relevant O&S Panel would set the timetable.

Councillor Brimacombe stated he was told the list in paragraph 6.5 on page 28 of the agenda pack was a standing agenda item. Rob Stubbs, Deputy Director and Head of Finance confirmed it was even more relevant as a standing agenda item as the risk register was presented to Corporate meetings quarterly. Steve Mappley, Insurance and Risk Manager confirmed that the item was not always listed to be included in the agenda for the Panel. Councillor Brimacombe registered some discontent over that as he felt it should not be a discretionary item. Councillor Saunders stated Members did not have the authority to tell people what to do, especially when there were other priorities. He added it might be appropriate to notify SLT to make the risk register a standing item every quarterly meeting and that it should be unmoveable. Councillor Brimacombe stated the process should reflect when it could be challenge. Councillor Saunders confirmed he would write a process based on what Members expected to occur and if people changed that, it was their choice. The Deputy Director and Head of Finance said he would push to ensure the report appeared on the agenda moving forward. A lot of audit reports were slow to receive a response so not, it was taken to SLT quarterly. Councillor Brimacombe again expressed discontent and urged the Panel to call the Managing Director to Panel every six months to explain why the report was not reviewed every quarter if it was to be moved going forward. Councillor E. Wilson stated the Panel needed to ensure the responsible risk owners attended Panel to answer questions on their risk management; he also wanted to know what risk management was like at other local authorities. Councillor Saunders stated he suspected the nature of risk within other local authorities compared to the Royal Borough as a whole was lower. The Borough was likely to sit in the upper quarter of Councils because the Borough was innovative and demanding as a Council. He stated this was especially the case due to the collaborative regeneration projects. Therefore, the Borough brought within orbit demanding risks unlike other councils. The Borough needed to share with developers any risks which pushed the Council up into the top quartile. If the Council took regeneration and joint ventures out, the Borough would rank lower in the third or fourth quartile. The Royal Borough only had a relatively modest level of vulnerable people and the Borough had driven efficiency of services for residents more than other councils due to joint ventures such as AfC or Optalis and Highways commissioning. If the Borough did not put in the right governance and chicks, the risks would increase. Councillor L. Evans stated the risks were lower but the exposure was higher. Councillor Saunders stated economy of scales, competence went up, knowledge etc increased meant potentially the Borough took on higher risks but, all the positives swamped that.

v  Action – Individual risk owners be invited to attend Panel to respond to and answer queries and question specific to the risks they manage.

RESOLVED UNANIMOUSLY: That the Audit and Performance Review Panel noted the report and;

i)             Endorsed the approach to managing risk.