Cairngorms Nation­al Park Author­ity Intern­al Audit Report: Risk Management

August 2019

Page 1

Cairngorms Nation­al Park Authority INTERN­AL AUDIT REPORT Risk Man­age­ment August 2019

CAIRNGORMS NATION­AL PARK AUTHORITY Audit & Risk Com­mit­tee Paper 2 Annex I 06/09/19

LEVEL OF ASSURANCE

Design	Oper­a­tion­al Effectiveness
Sub­stan­tial	Sub­stan­tial

BDO

Page 2

CON­TENTS

• Exec­ut­ive Sum­mary — 3
• Detailed Find­ings and Recom­mend­a­tions — 9
• Obser­va­tions — 12
• Appen­dices:
  • I Staff Inter­viewed — 13
  • II Defin­i­tions — 14
  • III Terms of Ref­er­ence — 15
  • IV Risk Register Format — 16
  • V Risk Matur­ity Mod­el — 17

REPORT STATUS

• Aud­it­ors: Sean Morrison
• Dates work per­formed: 02 July 2019 – 07 August 2019
• Draft report issued: 16 August 2019
• Final report issued: 19 August 2019

DIS­TRI­BU­TION LIST

• Dav­id Camer­on — Dir­ect­or of Cor­por­ate Services
• Audit Com­mit­tee — Members

Restric­tions of use

The mat­ters raised in this report are only those which came to our atten­tion dur­ing the course of our audit and are not neces­sar­ily a com­pre­hens­ive state­ment of all the weak­nesses that exist or all improve­ments that might be made. The report has been pre­pared solely for the man­age­ment of the organ­isa­tion and should not be quoted in whole or in part without our pri­or writ­ten con­sent. BDO LLP neither owes nor accepts any duty to any third party wheth­er in con­tract or in tort and shall not be liable, in respect of any loss, dam­age or expense which is caused by their reli­ance on this report.

Page 3

EXEC­UT­IVE SUMMARY

LEVEL OF ASSUR­ANCE (SEE APPENDIX II FOR DEFINITIONS)

• Design: There is a sound sys­tem of intern­al con­trol designed to achieve sys­tem objectives.
• Effect­ive­ness: The con­trols that are in place are being con­sist­ently applied.

SUM­MARY OF RECOM­MEND­A­TIONS (SEE APPENDIX II)

• High: ▲
• Medi­um: ●
• Low: ▼

Total num­ber of recom­mend­a­tions: 3

OVER­VIEW

Back­ground

It was agreed with man­age­ment and the Audit & Risk Com­mit­tee with­in the 2019 – 20 Intern­al Audit Plan that Intern­al Audit would review the key con­trols in place with­in Cairngorms Nation­al Park Author­ity (CNPA) in rela­tion to risk man­age­ment. The pur­pose of our review is to provide inde­pend­ent assur­ance to man­age­ment and the Audit & Risk Com­mit­tee that the con­trols in place in rela­tion to risk man­age­ment are well designed and oper­at­ing effectively.

BDO pre­vi­ously con­duc­ted a risk man­age­ment audit at CNPA, in August 2016. The audit provided mod­er­ate assur­ance over the design and oper­a­tion­al effect­ive­ness of the risk man­age­ment con­trols in place, with four recom­mend­a­tions made, two of which have been fully imple­men­ted as repor­ted with­in the 2018 – 19 fol­low up audit.

Since the pre­vi­ous audit CNPA has cre­ated a risk man­age­ment strategy. The strategy was developed in the first half of 2018, and approved by the Board in June 2018. The strategy out­lines the key respons­ib­il­it­ies for risk man­age­ment with­in CNPA and in par­tic­u­lar the tone from the top in rela­tion to risk man­age­ment. The strategy also notes the risk appet­ite adop­ted, and risk man­age­ment report­ing require­ments. The strategy is the key intern­al guid­ance doc­u­ment for risk man­age­ment, and is made avail­able to staff via the organisation’s pub­lic net­work folders and was com­mu­nic­ated intern­ally through the Man­age­ment Team and Oper­a­tion­al Man­age­ment Group meetings.

The Audit & Risk Com­mit­tee terms of ref­er­ence out­lines that it is the Committee’s respons­ib­il­ity to over­see the risk man­age­ment and cor­por­ate gov­ernance arrange­ments with­in the organ­isa­tion. The terms of ref­er­ence for the Man­age­ment Team (MT) out­lines the group’s risk man­age­ment respons­ib­il­it­ies, includ­ing the respons­ib­il­ity to devel­op policy on risk, over­see the stra­tegic risk register, agree mit­ig­a­tion plans and lead on imple­ment­a­tion of risk mit­ig­a­tion actions.

Page 4

EXEC­UT­IVE SUMMARY

OVER­VIEW

The Oper­a­tion­al Man­age­ment Group’s (OMG) remit details that they are respons­ible for man­aging risks to deliv­ery, and report­ing new and sig­ni­fic­ant risks to the MT for action. Risk man­age­ment respons­ib­il­it­ies for indi­vidu­al staff are reviewed and con­sidered as part of the annu­al job eval­u­ation process.

The Board con­sidered and approved the cur­rent format of the risk register in June 2018. The risk register format was developed by man­age­ment to sup­port the deliv­ery of the 2018 – 2022 Cor­por­ate Plan. The stra­tegic risk register format is illus­trated at Appendix IV of this report. The risks iden­ti­fied with­in the risk register are aligned to the stra­tegic pri­or­it­ies out­lined with­in the Cor­por­ate Plan and are cat­egor­ised into key themes, which are as follows:

1. Gov­ernance
2. Resources/​Resourcing
3. Staff­ing
4. Tech­nic­al
5. Repu­ta­tion
6. Part­ner­ships

Risks are assessed by CNPA to con­sider the like­li­hood of the risk occur­ring and the impact on the organ­isa­tion if the risk were to crys­tal­lise. The risk register records the risk scor­ing, with both like­li­hood and impact cat­egor­ised on a scale of 1 to 5 dur­ing the risk assess­ment pro­cess on a gross and net basis. The tar­get risk score is to reduce the like­li­hood mul­ti­plied by impact score of each risk (net score) to below 10 by apply­ing rel­ev­ant risk treat­ments. The trend score for the risk is also recor­ded on the risk register, which notes the three most recent quar­ters scor­ing. The risk register also details the risk descrip­tion, ref­er­ence to the Cor­por­ate Plan, risk own­ers, mit­ig­at­ing con­trols and com­ments on the risk envir­on­ment. The risks recor­ded in the risk register are sep­ar­ated between cross-over risks and spe­cif­ic ser­vice area risks.

Risks are iden­ti­fied through a range of chan­nels with­in the organ­isa­tion. Most typ­ic­ally they are iden­ti­fied via dis­cus­sion for inclu­sion on the risk register at the OMG and MT meet­ings, and escal­ated to the Audit & Risk Com­mit­tee and the Board on a quarterly basis for approv­al to include with­in the register. Both the Audit & Risk Com­mit­tee and the Board are also presen­ted with the oppor­tun­ity to high­light emer­ging risks at their respect­ive meetings.

Page 5

EXEC­UT­IVE SUMMARY

OVER­VIEW

CNPA’s risk man­age­ment pro­cesses are sup­por­ted through report­ing arrange­ments at a stra­tegic and man­age­ment level. The stra­tegic risk register is reviewed by the Board twice a year, along­side Cor­por­ate Plan per­form­ance reports pre­pared by the Dir­ect­or of Cor­por­ate Ser­vices. This provides the Board the oppor­tun­ity to assess the con­tent of the risk register, and as pre­vi­ously noted, to identi­fy gaps with­in the register.

The Audit & Risk Com­mit­tee review the risk register twice a year, in the peri­ods where a full review is not con­duc­ted by the Board. The Com­mit­tee con­sider the con­tent of the register and identi­fy addi­tion­al risks for the risk register. The Com­mit­tee are also provided with risk man­age­ment cov­er reports pre­pared by the Dir­ect­or of Cor­por­ate Ser­vices, provid­ing an exec­ut­ive sum­mary of the organisation’s risk envir­on­ment. Risk inter­rog­a­tion reports are also presen­ted to the Audit and Risk Com­mit­tee dur­ing the risk register reviews, which provide a deep dive into a spe­cif­ic risk with­in the register.

Seni­or man­age­ment review the risk register at the monthly OMG meet­ings to dis­cuss the con­tent of the risk register, and the actions being taken to mit­ig­ate the risks.

Risk man­age­ment train­ing is avail­able to staff upon request, and is included with­in the induc­tion pro­cess for Board mem­bers. The Dir­ect­or of Cor­por­ate Ser­vices provides one to one guid­ance on the risk man­age­ment pro­cesses to any new mem­bers of the organ­isa­tion who are in a pos­i­tion to be respons­ible for risks.

Scope and Approach

The scope of our review was to assess whether:

• A suit­able risk strategy and policy is in place.
• The struc­ture, roles and respons­ib­il­it­ies for risk man­age­ment are clear, includ­ing the respect­ive roles and respons­ib­il­it­ies of the Board, Audit & Risk Com­mit­tee, and Management.
• CNPA has robust sys­tems for identi­fy­ing and eval­u­at­ing all sig­ni­fic­ant stra­tegic and oper­a­tion­al risks.
• Mit­ig­at­ing con­trols, net risk and tar­get risk are suf­fi­ciently iden­ti­fied and agreed.
• Report­ing arrange­ments in place for risk man­age­ment are appropriate.
• Appro­pri­ate risk man­age­ment train­ing is being provided.

Our approach was to con­duct inter­views to estab­lish the con­trols and pro­cesses in oper­a­tion, and to review doc­u­ment­ary evid­ence that these con­trols are designed as described. We then eval­u­ated these con­trols to identi­fy wheth­er they adequately address the risks.

Page 6

EXEC­UT­IVE SUMMARY

OVER­VIEW

Good Prac­tice

We noted a num­ber of areas of good prac­tice being demon­strated at the Author­ity in rela­tion to risk man­age­ment. These included:

• A risk strategy has been developed for the organ­isa­tion, which was reviewed and approved by the Board in June 2018.
• Roles and respons­ib­il­it­ies for risk man­age­ment of the Audit & Risk Com­mit­tee and man­age­ment have been clearly defined.
• A stra­tegic risk register is in place and con­tains mit­ig­at­ing con­trols and actions, which are iden­ti­fied and agreed by management.
• Effect­ive report­ing arrange­ments are in place for risk man­age­ment, includ­ing review of the stra­tegic risk register and risk reports twice per year by both the Audit & Risk Com­mit­tee and the Board.
• Risk man­age­ment train­ing is avail­able to staff when reques­ted, and is provided to Board mem­bers dur­ing their induc­tion process.
• Risk inter­rog­a­tion reports are presen­ted to the Audit & Risk Committee.

Key Find­ings

Not with­stand­ing the areas of good prac­tice noted above, we have noted areas where fur­ther improve­ments can be made to the risk man­age­ment pro­cesses, sum­mar­ised below:

• Risk Man­age­ment Pro­ced­ure — We recog­nise that CNPA have developed a risk man­age­ment strategy which has inform­a­tion on risk appet­ite, dir­ec­tion and roles and respons­ib­il­it­ies. How­ever, the doc­u­ment lacks some of the fol­low­ing inform­a­tion that we would expect to see with­in a risk man­age­ment guid­ance document:
  1. Risk man­age­ment pro­cess, includ­ing iden­ti­fic­a­tion, assess­ment, ana­lys­is, response, mit­ig­a­tion and escalation.
  2. Risk register format.
  3. Risk prompts and tools.
  4. Risk impact and like­li­hood descriptions.

Page 7

EXEC­UT­IVE SUMMARY

OVER­VIEW

• Risk Iden­ti­fic­a­tion – We recog­nise that the Author­ity man­age­ment and Board mem­bers have cre­ated a detailed risk register, and that oppor­tun­it­ies are there for unre­cor­ded risks or gaps to be iden­ti­fied. How­ever, there is no peri­od­ic risk iden­ti­fic­a­tion exer­cise under­taken util­ising best prac­tice prompts, such as PESTLE and SWOT.
• Mit­ig­at­ing Con­trols — The CNPA risk registers do not clearly out­line wheth­er mit­ig­at­ing con­trols are pre­vent­at­ive or remedial.

Con­clu­sion

We are able to provide sub­stan­tial assur­ance over the design and oper­a­tion­al effect­ive­ness of the con­trols in place relat­ing to risk man­age­ment at CNPA.

Page 8

EXEC­UT­IVE SUMMARY

RISKS REVIEWED GIV­ING RISE TO NO FIND­INGS OF A HIGH OR MEDI­UM SIGNIFICANCE

• ☑ Cairngorms NPA may not have set out clearly its stra­tegic dir­ec­tion and object­ives in rela­tion to risk man­age­ment (includ­ing policy, roles and respons­ib­il­it­ies, object­ives and communications).
• ☑ Cairngorms NPA may not have adop­ted a sys­tem­at­ic pro­cess in identi­fy­ing, eval­u­at­ing and meas­ur­ing its key stra­tegic and oper­a­tion­al risks.
• ☑ Cairngorms NPA may not have adequate report­ing to its com­mit­tees and the Board in rela­tion to risk man­age­ment activities.
• ☑ Cairngorms NPA may not be provid­ing appro­pri­ate risk man­age­ment training.

Page 9

DETAILED FIND­INGS AND RECOMMENDATIONS

RISK: Cairngorms NPA may not have set out clearly its stra­tegic dir­ec­tion and object­ives in rela­tion to risk man­age­ment (includ­ing policy, roles and respons­ib­il­it­ies, object­ives and communication).

Ref.	Find­ing	Sig.	Recom­mend­a­tion
1	Risk Man­age­ment Procedure		We recom­mend that a risk man­age­ment pro­ced­ure is developed or that the risk man­age­ment strategy is updated to include the fol­low­ing best prac­tice areas: Risk man­age­ment pro­cess, includ­ing iden­ti­fic­a­tion, assess­ment, ana­lys­is, response, mit­ig­a­tion and escal­a­tion. Risk register format. Risk prompts and tools. Risk impact and like­li­hood descriptions.

MAN­AGE­MENT RESPONSE

Agreed

RESPONS­IB­IL­ITY AND IMPLE­MENT­A­TION DATE

• Respons­ible Officer: Dir­ect­or of Cor­por­ate Services
• Imple­ment­a­tion Date: 31 May 2020

Page 10

DETAILED FIND­INGS AND RECOMMENDATIONS

RISK: Cairngorms NPA may not have adop­ted a sys­tem­at­ic pro­cess in identi­fy­ing, eval­u­at­ing and meas­ur­ing its key stra­tegic and oper­a­tion­al risks.

Ref.	Find­ing	Sig.	Recom­mend­a­tion
2	Risk Iden­ti­fic­a­tion		We recom­mend that on a peri­od­ic basis, for example every two years to align with the start and mid-point of the Cor­por­ate Plan cycle, for man­age­ment to carry out a full scale risk iden­ti­fic­a­tion pro­cess for the risk register.

MAN­AGE­MENT RESPONSE

Agreed

RESPONS­IB­IL­ITY AND IMPLE­MENT­A­TION DATE

• Respons­ible Officer: Dir­ect­or of Cor­por­ate Services
• Imple­ment­a­tion Date: 31 May 2020

Page 11

DETAILED FIND­INGS AND RECOMMENDATIONS

RISK: Cairngorms NPA may not have adop­ted a sys­tem­at­ic pro­cess in identi­fy­ing, eval­u­at­ing and meas­ur­ing its key stra­tegic and oper­a­tion­al risks.

Ref.	Find­ing	Sig.	Recom­mend­a­tion
3	Mit­ig­at­ing Controls	☑	We recom­mend that man­age­ment con­sider detail­ing both pre­vent­at­ive and remedi­al con­trols with­in the risk register.

MAN­AGE­MENT RESPONSE

Agreed

RESPONS­IB­IL­ITY AND IMPLE­MENT­A­TION DATE

• Respons­ible Officer: Dir­ect­or of Cor­por­ate Services
• Imple­ment­a­tion Date: 30 Novem­ber 2019

Page 12

OBSER­VA­TIONS

Risk Train­ing

CNPA man­age­ment are cur­rently dis­cuss­ing the facil­it­a­tion of an Audit & Risk Com­mit­tee work­shop to be con­duc­ted by BDO. It is expec­ted that this will be an oppor­tun­ity to provide the mem­bers with best prac­tice guid­ance on risk man­age­ment, and in par­tic­u­lar the Author­ity are inter­ested in receiv­ing risk appet­ite advice.

Pri­or Audit Findings

The 2016 BDO risk man­age­ment audit has two recom­mend­a­tions out­stand­ing as of the most recent fol­low up audit con­duc­ted for the 2018 – 19 audit year. These recom­mend­a­tions have been noted below, and require a revised timetable for com­ple­tion to be agreed:

1. Pro­ject risk registers to be com­pleted in a con­sist­ent man­ner for all projects.
2. Staff are required to con­firm wheth­er they are aware of the organisation’s risk man­age­ment approach.

Page 13

APPENDIX I — STAFF INTERVIEWED

NAME	JOB TITLE
Dav­id Cameron	Dir­ect­or of Cor­por­ate Services

BDO LLP appre­ci­ates the time provided by all the indi­vidu­als involved in this review and would like to thank them for their assist­ance and cooperation.

Page 14

APPENDIX II — DEFINITIONS

LEVEL OF ASSURANCE

DESIGN of intern­al con­trol frame­work	OPER­A­TION­AL EFFECT­IVE­NESS of intern­al controls
Find­ings from review	Design Opin­ion	Find­ings from review	Effect­ive­ness Opinion
Sub­stan­tial	Appro­pri­ate pro­ced­ures and con­trols in place to mit­ig­ate the key risks.	There is a sound sys­tem of intern­al con­trol designed to achieve sys­tem objectives.	No, or only minor, excep­tions found in test­ing of the pro­ced­ures and controls.	The con­trols that are in place are being con­sist­ently applied.
Mod­er­ate	In the main there are appro­pri­ate pro­ced­ures and con­trols in place to mit­ig­ate the key risks reviewed albeit with some that are not fully effective.	Gen­er­ally a sound sys­tem of intern­al con­trol designed to achieve sys­tem object­ives with some exceptions.	A small num­ber of excep­tions found in test­ing of the pro­ced­ures and controls.	Evid­ence of non com­pli­ance with some con­trols, that may put some of the sys­tem object­ives at risk.
Lim­ited	A num­ber of sig­ni­fic­ant gaps iden­ti­fied in the pro­ced­ures and con­trols in key areas. Where prac­tic­al, efforts should be made to address in-year.	Sys­tem of intern­al con­trols is weakened with sys­tem object­ives at risk of not being achieved.	A num­ber of reoc­cur­ring excep­tions found in test­ing of the pro­ced­ures and con­trols. Where prac­tic­al, efforts should be made to address in-year.	Non-com­pli­ance with key pro­ced­ures and con­trols places the sys­tem object­ives at risk.
No	For all risk areas there are sig­ni­fic­ant gaps in the pro­ced­ures and con­trols. Fail­ure to address in-year affects the qual­ity of the organisation’s over­all intern­al con­trol framework.	Poor sys­tem of intern­al control.	Due to absence of effect­ive con­trols and pro­ced­ures, no reli­ance can be placed on their oper­a­tion. Fail­ure to address in-year affects the qual­ity of the organisation’s over­all intern­al con­trol framework.	Non com­pli­ance and/​or com­pli­ance with inad­equate controls.

Recom­mend­a­tion Significance

• High: A weak­ness where there is sub­stan­tial risk of loss, fraud, impro­pri­ety, poor value for money, or fail­ure to achieve organ­isa­tion­al object­ives. Such risk could lead to an adverse impact on the busi­ness. Remedi­al action must be taken urgently.
• Medi­um: A weak­ness in con­trol which, although not fun­da­ment­al, relates to short­com­ings which expose indi­vidu­al busi­ness sys­tems to a less imme­di­ate level of threat­en­ing risk or poor value for money. Such a risk could impact on oper­a­tion­al object­ives and should be of con­cern to seni­or man­age­ment and requires prompt spe­cif­ic action.
• Low: Areas that indi­vidu­ally have no sig­ni­fic­ant impact, but where man­age­ment would bene­fit from improved con­trols and/​or have the oppor­tun­ity to achieve great­er effect­ive­ness and/​or efficiency.

Page 15

APPENDIX III — TERMS OF REFERENCE

BACK­GROUND

As part of the pre­par­a­tion of the 2019 – 20 Intern­al Audit Strategy and plan, it was agreed that intern­al audit would review the risk man­age­ment frame­work in place with­in Cairngorms NPA and com­pare this with good prac­tice, using our risk man­age­ment matur­ity model.

PUR­POSE OF REVIEW

The pur­pose of this review is to provide the Audit and Risk Com­mit­tee with a level of assur­ance around the cur­rent risk man­age­ment arrange­ments, and to provide man­age­ment with advice and recom­mend­a­tions for improv­ing the arrange­ments fur­ther. It will also inform Man­age­ment and the Audit and Risk Com­mit­tee of improve­ments in risk man­age­ment pro­cess maturity.

KEY RISKS

Based upon dis­cus­sions with man­age­ment, and our col­lect­ive audit know­ledge and under­stand­ing the key risks asso­ci­ated with the area under review are:

• Cairngorms NPA may not have set out clearly its stra­tegic dir­ec­tion and object­ives in rela­tion to risk man­age­ment (includ­ing policy, roles and respons­ib­il­it­ies, object­ives and communication).
• Cairngorms NPA may not have adop­ted a sys­tem­at­ic pro­cess in identi­fy­ing, eval­u­at­ing and meas­ur­ing its key stra­tegic and oper­a­tion­al risks.
• Cairngorms NPA may not have adequate report­ing to its com­mit­tees and the Board in rela­tion to risk man­age­ment activities.
• Cairngorms NPA may not be provid­ing appro­pri­ate risk man­age­ment training.

SCOPE

The fol­low­ing areas will be covered as part of this review:

• To assess wheth­er a suit­able risk strategy and policy is in place.
• To assess wheth­er the struc­ture, roles, and respons­ib­il­it­ies for risk man­age­ment are clear, includ­ing the respect­ive roles and respons­ib­il­it­ies of the Board, Audit Com­mit­tee and Management.
• To assess wheth­er Cairngorms NPA has robust sys­tems for identi­fy­ing and eval­u­at­ing all sig­ni­fic­ant stra­tegic and oper­a­tion­al risks.
• To assess wheth­er mit­ig­at­ing con­trols, net risk and tar­get risk are suf­fi­ciently iden­ti­fied and agreed.
• To assess wheth­er the report­ing arrange­ments in place for risk man­age­ment are appropriate.
• To assess wheth­er appro­pri­ate risk man­age­ment train­ing is being provided.

Page 16

APPENDIX IV — RISK REGISTER FORMAT

CAIRNGORMS NATION­AL PARK AUTHOR­ITY STRA­TEGIC RISK REGISTER

Risk	Ref	Resp	Mit­ig­a­tion	Com­ments	Trend Aug 18	Trend Nov 18	Trend Mar 19
Cross-over risks Resources: pub­lic sec­tor fin­ances con­strain capa­city to alloc­ate suf­fi­cient resources to deliv­er cor­por­ate plan.	AI	DC	Focus resource on diver­si­fic­a­tion of income streams to altern­ate, non-pub­lic income gen­er­a­tion. Con­tinu­ing to sup­port ​“deliv­ery bod­ies” such as Cairngorms Nature, LAG and OATS in secur­ing inward invest­ment. Cor­por­ate plan pri­or­it­ised around anti­cip­ated Scot­tish Gov­ern­ment budget alloc­a­tions, tak­ing on Board expect­a­tion of fund­ing con­straints. Ongo­ing liais­on with Scot­tish Gov­ern­ment high­light­ing achieve­ments of CNPA.	Work with Scot­tish Gov­ern­ment has suc­cess­fully secured resources adequate to cov­er Cor­por­ate Plan expect­a­tions into the second year of the new Cor­por­ate Plan peri­od. We also con­tin­ue to take for­ward ideas for altern­ate income streams to sup­port future invest­ment, includ­ing col­lect­ive work with all UK Nation­al Parks and now sup­port­ing work on char­it­able activ­it­ies through Cairngorms Trust.

Page 17

APPENDIX V – BDO RISK MATUR­ITY ASSESS­MENT MODEL

Risk Gov­ernance	Risk Iden­ti­fic­a­tion and Assess­ment	Risk Mit­ig­a­tion and Treat­ment	Risk Report­ing and Review	Con­tinu­ous Improvement
Enabled Fully embed­ded into oper­a­tions. All parties play their part and have a share of account­ab­il­ity for man­aging risk in line with their respons­ib­il­ity for the achieve­ment of objectives.	There are pro­cesses for identi­fy­ing and assess­ing risks and oppor­tun­it­ies on a con­tinu­ous basis. Risks are assessed to ensure con­sensus about the appro­pri­ate level of con­trol, mon­it­or­ing and report­ing to carry out. Risk inform­a­tion is doc­u­mented in a risk register.	Responses to the risks have been selec­ted and imple­men­ted. There are pro­cesses for eval­u­at­ing risks and responses imple­men­ted. The level of resid­ual risk after apply­ing mit­ig­a­tion tech­niques is accep­ted by the organ­isa­tion, or fur­ther mit­ig­a­tions have been planned.	High qual­ity, accur­ate and timely inform­a­tion is avail­able to oper­a­tion­al man­age­ment and dir­ect­ors. The board reviews the risk man­age­ment strategy, policy and approach on a reg­u­lar basis, e.g. annu­ally, and reviews key risks, emer­gent and new risks, and action plans on a reg­u­lar basis, e.g. quarterly.	The organ­isa­tion­al per­form­ance man­age­ment frame­work and reward struc­ture drives improve­ments in risk man­age­ment. Risk man­age­ment is a man­age­ment com­pet­ency. Man­age­ment assur­ance is provided on the effect­ive­ness of their risk man­age­ment on a reg­u­lar basis.
Man­aged Risk man­age­ment object­ives are defined and man­age­ment are trained in risk man­age­ment tech­niques. Risk man­age­ment is writ­ten into the per­form­ance expect­a­tions of man­agers. Man­age­ment and exec­ut­ive level respons­ib­il­it­ies for key risks have been allocated.	There are clear links between object­ives and risks at all levels. Risk inform­a­tion is doc­u­mented in a risk register. The organisation’s risk appet­ite is used in the scor­ing sys­tem for assess­ing risks. All sig­ni­fic­ant pro­jects are routinely assessed for risk.	There is clar­ity over the risk level that is accep­ted with­in the organisation’s risk appet­ite. Risk responses appro­pri­ate to sat­is­fy the risk appet­ite of the organ­isa­tion have been selec­ted and implemented.	The board reviews key risks, emer­gent and new risks, and action plans on a reg­u­lar basis, e.g. quarterly. It reviews the risk man­age­ment strategy, policy and approach on a reg­u­lar basis, e.g. annu­ally. Dir­ect­ors require inter­im updates from del­eg­ated man­agers on indi­vidu­al risks which they have per­son­al responsibility.	The organisation’s risk man­age­ment approach and the Board’s risk appet­ite are reg­u­larly reviewed and refined in light of new risk inform­a­tion repor­ted. Man­age­ment assur­ance is provided on the effect­ive­ness of their risk man­age­ment on an ad hoc basis. The resources used in risk man­age­ment become quan­ti­fi­ably cost effect­ive. KPIs are set to improve cer­tain aspects of the risk man­age­ment activ­ity, e.g. timeli­ness of imple­ment­a­tion of risk responses, num­ber of risks mater­i­al­ising or sur­pass­ing impact-like­li­hood expectations.
Defined A risk strategy and policies are in place and com­mu­nic­ated. The level of risk tak­ing that the organ­isa­tion will accept is defined and under­stood in some parts of the organ­isa­tion, and it is used to con­sider the most appro­pri­ate responses to the man­age­ment of iden­ti­fied risks. Man­age­ment and exec­ut­ive level respons­ib­il­it­ies for key risks have been allocated.	There are pro­cesses for identi­fy­ing and assess­ing risks and oppor­tun­it­ies in some parts of the organ­isa­tion but not con­sist­ently applied in all. All risks iden­ti­fied have been assessed with a defined scor­ing sys­tem. Risk inform­a­tion is brought togeth­er for some parts of the organ­isa­tion. Most pro­jects are assessed for risk.	Man­age­ment in some parts of the organ­isa­tion are famil­i­ar with, and able to dis­tin­guish between, the dif­fer­ent options avail­able in respond­ing to risks to select the best response in the interest of the organisation.	Man­age­ment have set up meth­ods to mon­it­or the prop­er oper­a­tion of key pro­cesses, responses, and action plans. Man­age­ment report risks to dir­ect­ors where responses have not man­aged the risks to a level accept­able to the board.	The Board gets min­im­al assur­ance on the effect­ive­ness of risk management.
Aware There is a scattered, silo-based approach to risk man­age­ment. The vis­ion, com­mit­ment and own­er­ship of risk man­age­ment have been doc­u­mented. How­ever, the organ­isa­tion is reli­ant on a few key people for the know­ledge, skills and the prac­tice of risk man­age­ment activ­it­ies on a day-to-day basis.	A lim­ited num­ber of man­agers are trained in risk man­age­ment tech­niques. There are pro­cesses for identi­fy­ing and assess­ing risks and oppor­tun­it­ies, but these are not fully com­pre­hens­ive or imple­men­ted. There is no con­sist­ent scor­ing sys­tem for assess­ing risks. Risk inform­a­tion is not fully documented.	Some responses to the risks have been selec­ted and imple­men­ted by man­age­ment accord­ing to their own per­cep­tion of risk appet­ite in the absence of a board-approved appet­ite for risk.	There are some mon­it­or­ing pro­cesses and ad hoc reviews by some man­agers on risk man­age­ment activities.	Man­age­ment does not assure the Board on the effect­ive­ness of risk management.
Naïve No form­al approach developed for risk man­age­ment. No form­al con­sid­er­a­tion of risks to busi­ness object­ives, or clear own­er­ship, account­ab­il­ity and respons­ib­il­ity for the man­age­ment of key risks.	Pro­cesses for identi­fy­ing and eval­u­at­ing risks and responses are not defined. Risks have not been iden­ti­fied nor col­lated. There is no con­sist­ent scor­ing sys­tem for assess­ing risks.	Responses to the risks have not been designed or implemented.	There are no mon­it­or­ing pro­cesses or reg­u­lar reviews of risk management.	Man­age­ment does not assure the Board on the effect­ive­ness of risk management.

Page 18

BDO LLP, a UK lim­ited liab­il­ity part­ner­ship registered in Eng­land and Wales under num­ber OC305127, is a mem­ber of BDO Inter­na­tion­al Lim­ited, a UK com­pany lim­ited by guar­an­tee, and forms part of the inter­na­tion­al BDO net­work of inde­pend­ent mem­ber firms. A list of mem­bers’ names is open to inspec­tion at our registered office, 55 Baker Street, Lon­don W1U 7EU. BDO LLP is author­ised and reg­u­lated by the Fin­an­cial Con­duct Author­ity to con­duct invest­ment business.

BDO is the brand name of the BDO net­work and for each of the BDO Mem­ber Firms.

BDO North­ern Ire­land, a part­ner­ship formed in and under the laws of North­ern Ire­land, is licensed to oper­ate with­in the inter­na­tion­al BDO net­work of inde­pend­ent mem­ber firms.

Copy­right ©2019 BDO LLP. All rights reserved.

www​.bdo​.co​.uk