Risk Appetite Statement


Risk Appetite Statement

Our risk appetite guides how much risk we are willing to seek or accept to achieve our objectives. We recognise we will need to take risks, both in our ordinary business and to achieve the priorities set out in our Strategic Plan. Good risk management ensures we make well informed decisions and we understand the associated risks. By ensuring that we properly respond to risks we will be more likely to achieve our priorities. It also provides control and a high level of due diligence consistent with our responsibilities in managing public money.

We recognise effective risk management considers not just threats but also opportunities. So, our approach to risk is to seek the right opportunities and, where possible, minimise threats. By encouraging managed risk taking, and considering all of the available options we seek a balance between caution and innovation.

Our risk appetite reflects our current position; encouraging managed risk taking for minor to moderate level risks, but controlling more closely those risks that come further up the scale. Our appetite for risk will vary over time depending on our ambitions and priorities and the environment we work in.

Beyond our risk appetite is our risk tolerance. This sets the level of risk that is unacceptable, whatever opportunities might follow. In such instances we will aim to reduce the risk to a level that is within our appetite.

We illustrate our risk appetite and tolerance in the matrix below. The RED> shaded area represents the outer limit of our risk appetite, and the BLACK area indicates the tolerance. As a Council we are not willing to take risks that will cause a significant negative consequence for our objectives.

The matrix also illustrates how we monitor risks. The Council’s highest level risks (those with a combined score of 12 and above) are reported to Corporate Leadership Team for consideration and guidance.

Impact

   1 - Minimal 2 - Minor 3 - Moderate 4 - Major 5 - Catastrophic
Likelihood 5 - Almost Certain Monitor Quarterly Monitor Quarterly Monitor Monthly Monitor Monthly to CLT Monitor Monthly to CLT
4 - Likely Monitor 6-Monthly / Annually Monitor Quarterly Monitor Monthly Monitor Monthly Monitor Monthly to CLT
3 - Possible Monitor 6-Monthly / Annually Monitor Quarterly Monitor Quarterly Monitor Monthly Monitor Monthly
2 - Unlikely No Action Required Monitor 6-Monthly / Annually Monitor Quarterly Monitor Quarterly Monitor Quarterly
1 - Rare No Action Required No Action Required Monitor 6-Monthly / Annually Monitor 6-Monthly / Annually Business Continuity Plan

Risk Response

Risk Rating Risk Rating
20-25

Risks at this level sit above the tolerance of the Council and are of such magnitude that they form the Council’s biggest risks. The Council is not willing to take risks at this level and action should be taken immediately to manage the risk.

12-16 These risks are within the upper limit of risk appetite. While these risks can be tolerated, controls should be identified to bring the risk down to a more manageable level where possible.
5-10 These risks sit on the borders of the Council’s risk appetite and so while they don’t pose an immediate threat, they are still risks that should remain under review. If the impact or likelihood increases then risk owners should seek to manage the increase.
3-4 These are low level risks that could impede or hinder achievement of objectives. Due to the relative low level it is unlikely that additional controls will be identified to respond to the risk.
1-2 Minor level risks with little consequence but not to be overlooked completely. They are enough of a risk to have been assessed through the process, but unlikely to prevent the achievement of objectives.
Impact:5
Likelihood: 1
Rare events that have a catastrophic impact form part of the Council’s Business Continuity Planning response.