|
Mr Mike Adye
introduced the item, and Alexandra Johansen (EMS) provided her background
qualifications before outlining her role in facilitating the development of
HBRC’s organisation-governance integrated risk management framework.
Mr Adye and Ms
Johansen provided an overview of the Quantate framework for Council, the
set-up and controls; and the way the system works in arriving at the
aggregated register.
Staff’s suggested approach is:
·
Routine (6 monthly) reporting on risks to the
FA&R Sub-committee
·
Review previous 6-month Risk Assessment to
note changes / improvements / areas that require attention
·
Sub-committee carry out detailed review of
individual Group’s Risk Management (as part of the programmed reviews
of Groups)
·
Continue with Quantate risk assessment system,
and investigate benefits of using more comprehensive tools such as alerts,
task setting, control improvement plans and monitoring
Discussion traversed:
·
ensuring that no one staff member is
‘responsible’ for the framework, but rather that every team bears
responsibility for the management of their group’s risks
·
Role of sub-committee is to review the
framework to assure itself that appropriate, sufficient mitigation controls
are in place and processes are being followed and referring issues back to
staff for resolution and reporting back
·
The processes for identifying emerging risks
and adding new risks to Quantate, and the interaction between the
organisation and governance when risks are ‘elevated’ either
because insufficient controls in place or judged at the Executive or Governance
level to be significant
·
Further development of IT related risks around
security, including risks to reputation related to Councillors/Directors
document/information management on personal devices
·
Identified Cyber and Fraud as risks the
Governors expected to see ‘elevated’ in the register, as well as
loss of staff knowledge/continuity at each Group or project level
|
