Risk Management Strategy
Integration Joint Board
| Version. | Risk Management Strategy 2025. |
| Lead Manager. | Chief Finance Officer. |
| Approved by. | Integration Joint Board. |
| Date Approved. | Originally approved October 2018. |
| Date for Review. | April 2027. |
IMAGE: The cover displays the OHAC logo with the text “OHAC | orkney health and care”, followed by the title “Risk Management Strategy” and “Integration Joint Board.” The document details shown are Version: Risk Management Strategy 2025; Lead Manager: Chief Finance Officer; Approved by: Integration Joint Board; Date Approved: Originally approved October 2018; Date for Review: April 2027.
Contents
- Introduction — 3
- Risk Management Objectives — 3
- Responsibility — 4
- Approach to Managing Risk — 4
- Risk Appetite — 5
- Classification Matrix — 7
1. Introduction
As a separate legal entity, the Integration Joint Board (IJB) is required to have an approved Risk Management Strategy. This will ensure there are processes in place to identify significant risks to its corporate objectives.
This Strategy has been compiled using both NHS Orkney and the Orkney Islands Council (OIC)’s strategies, and aims to build on already established best practice, so that a robust and effective framework is in place for the management of risk. The framework will:
- Be proactive in understanding risk through a process of risk identification and assessment.
- Build upon existing good practice.
- Support better decision making through a good understanding of potential risks and their likely impact.
- Be integral to all decision making, planning, performance reporting and delivery processes.
This Strategy forms part of the wider framework for corporate governance and internal control within the IJB. The IJB will broadly face two types of risks: those which relate to its operation as a separate legal entity; and those which relate to the quality-of-service delivery which are experienced by commissioned services. For the latter, this will be largely reliant upon risks identified, assessed, and treated, by the parent organisations for commissioned services (NHS Orkney and OIC).
2. Risk Management Objectives
Risk is defined as the combination of the likelihood of an event occurring, or not occurring, as the case may be (as defined by the Chartered Institute of Public Finance and Accountancy (CIPFA)).
Risk can never be eliminated in its entirety, of course; however, managing risk can also identify positive opportunities which, with the appropriate level of control, may lead to service improvements. Therefore, the measures adopted are principles of good management practice which seek to realistically control, and balance, risk and opportunity.
The IJB’s risk management objectives are to:
- Anticipate and respond to changing social, environmental, and legislative, requirements.
- Prevent injury and/or harm, damage, and losses:
- Comply with health and safety and legislative requirements.
- Safeguard the public, NHS Orkney and OIC Board/Elected Members, employees, service users and all persons to whom the IJB has a duty of care.
- Preserve and enhance service delivery.
- Maintain effective control of public funds.
- Maintain and enhance the IJB’s reputation.
- Safeguard and enhance the quality of Orkney's environment.
3. Responsibility
The IJB is corporately responsible for this Risk Management Strategy and for ensuring that significant risks are adequately controlled. The Performance and Audit Committee has a responsibility for overseeing the operation of this Risk Management Strategy (as distinct from the management of specific risks).
The Chief Officer has overall accountability for risk management. The Chief Officer has delegated responsibility for reporting on risk to the Chief Finance Officer. The Chief Finance Officer is responsible for formally reporting on a quarterly basis to the Board on the development, and progress, of risk management, and for ensuring that the Risk Management Strategy is implemented and evaluated effectively.
The voting members have a collective responsibility, as a Board of Governance, to ensure risk management processes are providing them with adequate and appropriate information and assurances relating to risk, against the Board’s approved corporate objectives. In addition, voting members are responsible for ensuring that they are adequately equipped with the knowledge and skills to fulfil this role. The Board should receive training on risk management so that it can develop its own approach and, through workshop discussion, it can identify its strategic risk profile.
NHS Orkney and OIC are responsible for making sure that all staff are conversant with the Risk Management Strategy and have a working knowledge of all related risk policies. All staff must ensure that risk management is integral to their working practice.
4. Approach to Managing Risk
The IJB’s risk management approach will:
- Ensure risk management is clearly integrated and evidenced in the organisational culture.
- Inform all strategic and operational decisions using a risk identification process that assesses risk likelihood and impact.
Risk management is a continuous and critical process that enables the IJB to manage uncertainty, both positive and negative. Its approach to managing exposure to risk involves 4 key stages:
- Identification – what are the risks?
- Risk analysis assessment / evaluation – what is the likelihood of the risk occurring and how severe might be its impact?
- Prioritisation – which risks are more likely than others, and which risks will have the most severe impact?
- Risk management – action planning, controls, training, and procedures.
The IJB will assess all risks using the classification matrix, attached at Appendix 1, which will be applied consistently for corporate risks and for commissioned services.
Options for managing each risk are as follows: transfer, treat, terminate, tolerate.
Responses to risk should be proportionate to the level of risk exposure.
| Level of Risk. | Response to risk. |
|---|---|
| Low. | No additional controls are required, but any existing risk controls or contingency plans should be documented. The line manager should at least annually review whether controls are effective. |
| Medium. | Further action shall be taken to reduce the risk, but the cost of control will probably be modest. The line manager will document that the risk controls or contingency plans are effective. Twice annually, the service manager will seek assurance that these continue to be effective. |
| High. | Further action must be taken to reduce risk, possibly urgently, and possibly requiring significant resources. The line manager must document that the risk controls or contingency plans are effective. The relevant Manager or Chief Officer will seek assurance, at least quarterly, that these continue to be effective, and confirm that it is not reasonably practicable to do more. |
| Very High. | Given the gravity of the risk, the Chief Officer and relevant stakeholders must be explicitly informed. The Chief Officer must either urgently divert all possible resources to reduce the risk; suspend the situation presenting the risk until the risk can be reduced; abandon or significantly revise the threatened objective; or explicitly authorise that the risk is worth taking. |
IMAGE: The risk-response table uses colour coding to distinguish the four risk levels: Low is green, Medium is yellow, High is amber, and Very High is red.
All high or very high risks identified will require a supporting action plan that describes the activities being taken to mitigate the risk (or prevent the risk) to an acceptable tolerance level. It is acknowledged it may not be possible to mitigate some risks.
The IJB will also wish to be assured that business continuity arrangements are in place and effective, for all commissioned services.
5. Risk Appetite
Risk appetite is the amount of risk that the Board is prepared to accept, tolerate, or be exposed, to at any point in time. The Board may have different appetites for different categories of risk. As part of the Board’s annual performance review, the Board will consider its risk appetite for each of the categories of risk as set out below:
- Hungry (eager to be innovative and to choose options offering potentially bigger rewards, despite greater inherent risk).
- Open (willing to consider all options and choose the one that is most likely to result in success, while also providing an acceptable level of reward).
- Cautious (preference for safe delivery options that have a low degree of inherent risk and may only have limited potential for reward).
- Minimalist (preference for ultra-safe business delivery options that have a low degree of inherent risk and only have a potential for limited reward).
- Averse (avoidance of risk and uncertainty is a key organisational objective).
The Risk Register should be reviewed at least six monthly, and the risk appetite should be determined for the next 12-month period.
6. Classification Matrix
Risk Quantification Criteria
| Descriptor. | Rare (1). | Unlikely (2). | Possible (3). | Likely (4). | Almost Certain (5). |
|---|---|---|---|---|---|
| Likelihood. | Extremely unlikely – will only occur in exceptional circumstances (likely to occur every 5 to 10 years). | Not expected to happen, but potential exists – unlikely to occur (likely to occur every 2 to 5 years). | May occur occasionally; has happened on occasions – reasonable chance of occurring (likely to occur annually). | Strong possibility that this could occur – likely to occur (likely to occur quarterly). | This is expected to occur frequently and, in most circumstances, – more likely to occur than not (likely to occur daily / weekly / monthly). |
Please see the next page for Impact definitions.
Risk Matrix
| Likelihood. | Negligible (1). | Minor (2). | Moderate (3). | Major (4). | Extreme (5). |
|---|---|---|---|---|---|
| Almost Certain (5). | Medium (5). | High (10). | High (15). | Very High (20). | Very High (25). |
| Likely (4). | Medium (4). | Medium (8). | High (12). | High (16). | Very High (20). |
| Possible (3). | Low (3). | Medium (6). | Medium (9). | High (12). | High (15). |
| Unlikely (2). | Low (2). | Medium (4). | Medium (6). | Medium (8). | High (10). |
| Rare (1). | Low (1). | Low (2). | Low (3). | Medium (4). | Medium (5). |
IMAGE: The classification matrix presents likelihood against impact, with green cells for Low risks, yellow cells for Medium risks, amber cells for High risks, and red cells for Very High risks. The scores range from Low (1) to Very High (25).
- Very High: Senior manager action to confirm the level of risk identified and produce an action plan to eliminate, reduce, or transfer the risk.
- High: Service manager action to confirm the level of risk identified and produce an action plan to eliminate, reduce, or transfer the risk.
- Medium: Department action to confirm the level of risk identified and produce an action plan to eliminate, reduce, or transfer the risk.
- Low: Department action to confirm the level of risk identified and manage using routine procedures.
IMAGE: A colour-coded key identifies the required action for each risk level: Very High requires senior manager action; High requires service manager action; Medium requires department action and an action plan; Low requires department action using routine procedures.
Impact Definitions
| Descriptor. | Negligible (1). | Minor (2). | Moderate (3). | Major (4). | Extreme (5). |
|---|---|---|---|---|---|
| Patient / Service User Experience. | Reduced quality patient / service user experience. Outcome is not directly related to delivery of care. | Unsatisfactory patient / service user experience. Outcome is directly related to care provision – readily resolvable. | Unsatisfactory patient / service user experience. Outcome has short term effects – expected recovery is less than 1 week. | Significant impact on patient / service user experience. Outcome has medium term effects – expected recovery is less than 4 weeks. | Very significant impact on patient / service user experience. Outcome has long term effects – expected recovery more than 4 weeks. |
| Objectives / Project. | Barely noticeable reduction in scope / quality / project objectives / schedule, and ability to meet corporate objectives. No reputational damage anticipated. | Minor reduction in scope / quality / project objectives / schedule, and ability to meet corporate objectives. Little or no reputational damage anticipated. | Noticeable reduction in scope / quality / project objectives / schedule, and ability to meet corporate objectives. Some reputational damage anticipated. | Significant reduction in scope/ quality / project objective / schedule, and ability to meet corporate objectives. Significant reputational damage anticipated. | Very significant reduction in scope / quality / project objectives / schedule, and ability to meet corporate objectives. Very significant reputational damage anticipated. |
| Injury / Illness (Physical and Psychological) to Patient / Visitor / Staff. | Adverse event with no injury or illness. | Adverse event leading to minor injury or illness not requiring treatment. | Adverse event leading to moderate injury or illness requiring treatment. | Adverse event leading to significant injury or illness requiring intensive treatment. | Adverse event leading to death. |
| Complaints / Claims. | Unjustified verbal complaint or claim, or justified verbal complaint, locally resolved. | Justified written complaint or claim, but peripheral to care. | Justified written complaint or claim, relevant to care, but below insurance excess, with little or no reputational damage. | Justified written complaint or claim, relevant to care, exceeding insurance excess and / or resulting in significant reputational damage. | Justified written complaint or claim, relevant to care, exceeding insurance excess, in violation of laws, resulting in prosecution and / or very significant reputational damage. |
| Service / Business Interruption. | Disruption to service(s) which does not impact upon the delivery of patient care / service provision. | Disruption to service(s) with minor and acceptable impact on patient care / service provision. | Disruption to service(s) with moderate, but unacceptable, impact on patient care. service provision. | Disruption to service(s) with significant and unacceptable impact on patient care / service provision. | Disruption to, or elimination of, service(s) with catastrophic impact on patient care / service provision. |
| Staffing and Competence. | Short-term low staffing levels which temporarily reduces service quality (less than 1 day). | Short-term low staffing levels which temporarily reduces service quality (more than 1 days, but less than 7 days). | Medium-term low staffing levels which temporarily reduces service quality (more than 7 days, but less than 21 days). | Medium-term low staffing levels which reduce service quality (more than 21 days, less than 28 days). | Long-term low staffing levels which reduce service quality (more than 28 days). |
| Financial (including Damage / Loss / Theft / Fraud). | Negligible organisational / personal financial loss up to £100k. | Minor organisational / personal financial loss of £100k – £250k. | Significant organisational / personal financial loss of £250k – £500k. | Major organisational / personal financial loss of £500k – £1m. | Severe organisational financial loss of more than £1m. |
| Inspection / Audit. | Small number of recommendations which focus on minor quality improvement issues. No Reputational damage. | Recommendations made which can be addressed by low level of management action. Little or no reputational damage. | Challenging recommendations that can be addressed with appropriate action plan. Some local reputational damage. | Enforcement / prohibition action. Low Rating. Critical report. Improvement Notice from the Care Inspectorate. Significant local reputational damage | Prosecution. Zero rating. Severely critical report. Enforcement or Cancellation notice from the Care Inspectorate. Severe reputational damage, including national coverage. |
| Adverse Publicity / Reputation. | Rumours, with no media coverage. Little impact upon staff morale. | Local short-term media coverage. Some public embarrassment. Minor impact upon staff morale / public perception. | Local long-term adverse coverage. Significant impact upon staff morale / public perception. Local MSP / Scottish Executive Health Department interest. | National short-term media coverage of less than 3 days. Public confidence in the organisation undermined. Use of services affected. | National / International media coverage of more than 3 days. MSP / MP / Scottish Executive Health Department concern. (Questions in Parliament). Court Enforcement / Public Enquiry / Fatal Accident Enquiry. |
IMAGE: The impact definitions are presented in a five-column table covering Negligible, Minor, Moderate, Major and Extreme impacts across patient and service user experience, objectives and projects, injury or illness, complaints and claims, service or business interruption, staffing and competence, financial loss, inspection or audit, and adverse publicity or reputation.