6
The Committee received report ES/2628 of the Cabinet Member with responsibility for
Resources and Value for Money.
Councillor Langdon Morris introduced the report which updated the committee on the progress and current position of all the Council's corporate risks including significant changes to risk scores and updates following the last risk report to the Committee on the 14 July. The Corporate Leadership team regularly regularly review, monitor and manage risks and the corporate risk register is reported quarterly. Councillor Langdon Morris confirmed that significant updates to the risks included updates to Freeport East, Sizewell C, health and safety, and housing regulation risks. Local government reorganisation had also been entered as a separate risk.
The Chair invited questions.
Councillor Lynch referred to the graph at point 3.4.4 of the report and noted that grants from Sizewell C had moved to a high and critical position. Councillor Lynch asked that as the Council were not the ones doing the work on this site, why was this so high. East Suffolk Services Limited also seemed to be a relatively low risk given some issues that had been raised at a recent Overview and Scrutiny Committee meeting. The Head of Digital, Programme Management and Customer Services stated the Sizewell C risk had recently been raised, and this was mainly related to the Council's own resourcing for the next stage of the process. An explanation would be sought from the relevant Head of Service and circulated to the committee.
The Chief Executive stated he would see if the risk register could be circulated ahead of the papers to ensure the correct officers were present to provide an update. The Chair asked that Heads of Service for areas identified as in high, very high or major/catastrophic areas should attend the Committee. In relation to the risk from East Suffolk Services, this was shown in two risks, number 9 which was a red risk due to the financial risks, and number 27 which related to governance and was scored lower. The Head of Digital, Programme Management and Customer Services confirmed the financial elements had been separated out so they could be better monitored. Other risks around better recycling etc. were being managed within the project itself, and the deadlines for this were being hit and the financial risk was not impacting the rollout of this programme. This had not been escalated to the corporate risk register at this point but it would be raised with CLT.
The Chair referred to risk number 18 concerning water supply and stated this risk was already quite high, would it get any higher. The Head of Planning and Building Control stated that Essex and Suffolk Water were running a consultation on a water recycling project and additional sewage treatment. There was also a project for a new winter storage reservoir in either East Suffolk, Mid Suffolk or South Norfolk. The Head of Planning and Building Control stated he was confident that mitigation measures were being put in place.
The Chair referred to housing growth and greenfield development risk and asked if this related to increased greenfield development. The Head of Planning and Building Control stated this was a risk as local housing need had increased significantly and the local plan was over five years out of date. There was therefore a risk that unplanned development would come forward on greenfield sites.
Mr Jones highlighted risk 2 on cyber attacks and noted the Council relied on services from third parties and asked if the Council performed checks on these companies to ensure they were secure. The Head of Digital, Programme Management and Customer Services confirmed the two companies provided two different services. The Council used many hosted solutions, and the network was monitored 247 for potential issues by Nomios. The other company, 3B, provided expertise and reassurance. Where data was hosted it was backed up separately by the providers and the Council into a separate cloud environment.
Mr Jones referred to the disaster recovery plan and asked when this was tested. The Head of Digital, Programme Management and Customer Services stated this was tested in parts due to the way data was hosted between the sites. The Council would have to be taken offline for a few days to do a full test. Cyber security and disaster recovery was about to be audited and the results of this would be presented to the committee as part of the audit reports. Councillor Langdon Morris added that the Council had emergency planning officers and confirmed that the Council and town and parish councils were engaged on this to strengthen communities.
Councillor Lynch stated planning was one of the major responsibilities of the Council and there were major changes in this area but this did not appear as much as expected in the risk register. The Head of Planning and Building Control stated planning involved a lot of risk management itself but the biggest single risk to planning in the district was resource, similar to the risks associated with Sizewell C, and other unplanned development. Additional services had been recruited to manage this, and work had been done on planning enforcement.
The Chair asked if an additional risk on planning resource could be incorporated. The Head of Digital, Programme Management and Customer Services stated that risk 1 covered capacity to deliver, and a service level risk register would consider the risks around capacity for each team. There was also a risk on recruitment and retention which was also escalated up by teams to the Corporate Leadership Team through individual service area risk registers. The Chief Executive added that this was reviewed by the Corporate Leadership Team, and commented that while Councillors may receive the most correspondence on certain areas, there were other areas that could be seen as much higher risk such as housing. There had to be a balance between showing risks accurately and not overloading the risk register.
Ms Durrant referred to the safeguarding risk and asked if there was any consideration to lessons learned from incidents and quality improvement strategies here, especially from other agencies. The Head of Digital, Programme Management and Customer Services confirmed she would raise this with the Head of Service.
The Chair asked that a recommendation be added that the Corporate Leadership Team consider the risks related to ESSL and ensure this is appropriately reflected in the risk register. This was agreed by the committee.
On the proposal of Councillor Lynch, seconded by Councillor Gandy it was
RESOLVED
That Audit and Governance Committee:
1. Note and make comment on the corporate risks outlined on the Council’s current Corporate Risk Register (CRR) which is governed and monitored by the Corporate Leadership Team (CLT).