Risk management

The Board and the Executive Team lead the Board’s risk management process. Ownership of every identified risk lies with a named director. The Executive Team has named a senior manager as Risk Management Co-ordinator to deal with training, administrative and reporting issues within the Board’s risk framework.

The Board’s internal auditors have assured the Board that its risk management procedures comply with best practice, in the form of the Risk Management Standard of the Institute of Risk Management.

The Board provides training for all staff on risk management theory and practice. It encourages all staff to apply risk management techniques to setting and reviewing their personal and departmental objectives, and to contribute to preparing and reviewing risk registers.

The key elements of the Board’s risk management strategy are:

• clear and concise documentation and training for all staff on the Board’s definition of risk, its objectives in having a risk framework, and staff roles and responsibilities;
  
  
• a documented and communicated process of identifying and evaluating risks, assessing risk appetite, identifying and implementing suitable responses to risks, providing ongoing assurance about the effectiveness of the framework, and processes to embed and review risk awareness;
  
  
• multi-level review and reporting processes throughout the risk cycle, involving staff, managers, the Executive Team, internal audit, the Audit Committee and the Board; and
  
  
• identification and regular review of both the continuing appropriateness of the risks and responses identified and of the on-going status of the identified or planned responses to risks.

The key ways in which risk management is embedded in the Board are:

• the link between corporate planning and risk management processes;
  
  
• including risk in routine, regular operational reporting processes;
  
  
• the ownership of risks by directors and managers;
  
  
• involving Audit Committee and Board in agreeing and reviewing strategic and operational risks;
  
  
• including risk management in training plans;
  
  
• using risk registers for each of the Board’s projects, as part of the PRINCE2 project management methodology; and
  
  
• the documented timetable of monthly, quarterly and annual reviews of strategic and departmental risk profiles.