Issue - meetings

To provide an update on the Council’s current strategic risks (report of the Assistant Director – Governance enclosed).

Consideration was given to the report of the Assistant Director – Governance which provided members with an update on the Council’s current strategic risks.

The Business Intelligence and Change Manager introduced the report which included:

• Background to the Risk Report;
• A summary of all risks and scores which were detailed within the appendices;
• Overall risk spread;
• Risk treatment;
• The Strategic Risk Register was at Appendix A;
• The SHDC Housing Revenue Account (HRA) Risk Register was at Appendix B; and
• The Partnership Register was at Appendix C.

An error was noted on page 21 of the agenda pack in that ‘South Holland Strategic Risks should read ‘HRA Risks’.

Members considered the report and made the following comments:

• Members asked how often the risk registers were reviewed and whether the review process involved internal stakeholders.
  • The Business Intelligence and Change Manager responded that:
    • All risks were reviewed on a quarterly basis;
    • Each Assistant Director (AD) had committed to review risks relevant to their respective service areas;
    • Monitoring processes were in place to ensure reviews were undertaken. Any review not undertaken would be escalated to the Senior Leadership Team (SLT);
    • The risk registers were reported to the Corporate Management Team (CMT) on a monthly basis and to the Governance and Audit Committee on a quarterly basis; and
    • Operational risk registers were in place at service level. Any risk deemed to be ‘critical’ for two review cycles would be escalated to the strategic level. Likewise, if deemed acceptable, a risk could be moved from the strategic level to the operational level.

• Members queried the back-up processes in place to protect the council from IT threats, such as a ransomware attack.
  • The Business Intelligence and Change Manager would refer the query to the IT Manager and report back to the committee; and
  • The risk scores for IT were set at a level of toleration. Whilst the risk would always be ‘high’ due to the impact of a potential incident, mitigations were in place to reduce the likelihood of occurrences.

• Members referred to regular video communications to staff, noted on page 28 of the agenda, and asked whether the number of ‘views’ were assessed. The data could serve to inform whether the issue needed to be ‘treated’ rather than ‘tolerated’ in order to impact staff retention.
  • The Business Intelligence and Change Manager stated that the videos were accessed via an internal YouTube link which tracked the number of views. The data would be reported back to the committee; and
  • Staff surveys captured feedback regarding whether the workforce felt informed. Although the scores had been low, new mitigations had been implemented and the results were to be analysed after quarter three 2024/2025. The feedback would inform any changes to the treatment of this risk.

• Members queried whether any feedback had been received from local businesses regarding potential impact of the increased minimum wage.
  • The Business Intelligence and Change Manager would enquire and feedback to the committee after the meeting.

• Members noted the risk score of 16 for  ...  view the full minutes text for item 44