Risk Management Policy and Strategy

2026 to 2029

IMAGE: The Orkney Islands Council crest and logo appear above the document title. The cover identifies the document as “Risk Management Policy and Strategy 2026 to 2029”, prepared by Safety and Resilience, and gives the website www.orkney.gov.uk.

Contents

• 1. Policy Statement
• 2. Risk Management Principles
• 3. Application of the Risk Management Framework
     • 3.1 Governance
     • 3.2 Service Delivery
     • 3.3 Resilience
     • 3.4 Continuous Improvement
     • 3.5 Risk Categories
• 4. Governance Structure and Responsibilites
     • 4.1 Structure
     • 4.2 Responsibilities
• 5. Oversight
     • 5.1 Assurance
     • 5.2 Monitoring
     • 5.3 Escalation
     • 5.4 Review
• 6. Appendices

Document Control sheet.

Approval History

Review Change Record

1. Policy Statement

1.1 Purpose

The purpose of this Policy and Strategy is to establish a consistent, structured and proportionate approach to risk management across the Council. It provides a framework for the identification, assessment, management, monitoring and reporting of risks, supporting informed decision-making, effective governance, resilience, service delivery and compliance with statutory and regulatory requirements. By embedding risk management into planning, decision-making and operational activities, the Policy and Strategy supports the achievement of Council objectives and the delivery of positive outcomes for communities and stakeholders.

1.2 Scope

This Policy applies to all employees of Orkney Islands Council and covers all services, functions, assets, projects and programmes. It is intended to provide a consistent approach to risk management across all areas of activity, including corporate services, operational services, educational establishments, Marine Services, Harbour Authority functions and other service delivery arrangements. The principles of this Policy will also inform participation in partnership arrangements and, where appropriate, contractual arrangements with suppliers and contractors. Where contractual arrangements require compliance with specific risk management requirements, suppliers and contractors will be expected to fulfil those obligations. Risks arising from partnership arrangements, contractual relationships and third-party activities should be considered as part of wider risk management arrangements.

Orkney Islands Council recognises that effective risk management is fundamental to good governance, informed decision-making, organisational resilience and the achievement of strategic and operational objectives. Effective risk management enables uncertainty to be managed in a structured and proportionate manner, supporting the delivery of services, the protection of resources and the successful achievement of intended outcomes.

Uncertainty can create both risks and opportunities. A structured and proportionate approach to risk management supports the delivery of services, protects resources and assets, enhances outcomes for communities and stakeholders, and promotes informed and effective decision-making.

This Policy and Strategy establishes the framework through which risks are identified, assessed, managed, monitored and reported.

Implementation of this Policy and Strategy is supported by the Risk Management Framework and Guidance and the Risk Assessment Guidance, which together provide the operational arrangements and methodology for managing risk across all services, projects, programmes and partnership activities.

2. Risk Management Principles

The Risk Management Framework is aligned with the principles of ISO 31000:2018. Risk management is embedded within organisational activities and decision-making processes through a structured, consistent and proportionate approach to the identification, assessment, management and monitoring of risk.

Effective risk management is characterised by the following principles:

• Creates and protects value by supporting the achievement of objectives and the delivery of services.
• Is integrated into governance, planning, decision-making and operational activities.
• Is structured and comprehensive, providing a consistent and proportionate approach to managing risk across the Council.
• Is customised to reflect the Council's objectives, operating environment, functions and services.
• Is inclusive, drawing upon appropriate stakeholder engagement, knowledge and experience to support informed decision-making.
• Is dynamic and responsive to changing circumstances, emerging risks and new opportunities.
• Is informed by the best available information, recognising both the value and limitations of available data and evidence.
• Takes account of human and cultural factors, recognising the influence of leadership, behaviours and organisational culture.
• Promotes continual improvement through learning, review, assurance and performance monitoring.

Risk may present both threats and opportunities. Effective risk management supports informed decision-making, organisational resilience, continual improvement and the successful achievement of objectives. By identifying and managing uncertainty in a structured and proportionate manner, opportunities can be realised while potential adverse impacts are minimised. This enables informed choices to be made, resources to be directed effectively and emerging challenges to be addressed proactively.

For the purposes of this Policy and Strategy, risk is defined as:

"The effect of uncertainty on objectives."

2.1 Legislative and Regulatory Context

Risk management arrangements support compliance with relevant legislation, regulatory requirements, recognised standards and professional guidance. They contribute to effective governance, informed decision-making and the fulfilment of statutory duties.

Implementation of this Policy and Strategy will be informed by applicable legislation, national guidance and recognised best practice, including guidance issued by the Scottish Government, Audit Scotland, the Convention of Scottish Local Authorities (COSLA), the Society of Local Authority Chief Executives and Senior Managers (SOLACE), the Health and Safety Executive (HSE), the Information Commissioner's Office (ICO), the Scottish Public Finance Manual (SPFM) and other relevant professional and regulatory bodies where appropriate.

Risk management arrangements will be reviewed periodically to ensure they remain effective, proportionate and aligned with changing requirements, Council priorities and emerging best practice. Lessons identified through incidents, audits and assurance activities will support continual improvement.

3. Application of the Risk Management Framework

3.1 Governance

Risk management is embedded within governance, planning and decision-making arrangements. Clear lines of accountability, oversight and assurance are maintained through the governance framework, with committees responsible for corporate governance and risk management providing appropriate scrutiny and assurance. Overall accountability for the effectiveness of the Risk Management Framework rests with the Chief Executive, supported by the Corporate Leadership Team, Directors and Heads of Service, who are responsible for integrating risk management into strategic, directorate and service planning, decision-making and operational delivery.

3.2 Service Delivery

Directors, Heads of Service and Risk Owners are responsible for ensuring that risks which may affect service delivery, resource management, projects and Council priorities are appropriately identified, assessed and managed. Risk management supports informed decision-making, the protection of critical services and the achievement of strategic and operational objectives.

3.3 Resilience

Risk management supports council resilience by enhancing preparedness, protecting critical services and strengthening the ability to anticipate, respond to and recover from disruption. This includes consideration of business continuity, information and cyber security, climate-related risks and collaborative resilience planning with communities and partner organisations.

Risk management arrangements support and are informed by wider resilience structures operating at local, regional and national levels. Relevant risks, threats and planning assumptions identified through the National Risk Assessment (NRA), the North of Scotland Regional Resilience Partnership (RRP), the Local Resilience Partnership (LRP), and other resilience planning arrangements should be considered alongside strategic, operational and service risk information to support preparedness, business continuity, emergency planning and organisational resilience.

Risk management does not stop at organisational boundaries. Statutory and strategic partnerships, including arrangements involving the Integration Joint Board (IJB), Orkney Health and Social Care Partnership (OHASCP), NHS Orkney and other partner organisations, create shared risks and dependencies that require effective oversight and management. Risks arising from partnership arrangements should be managed through appropriate governance structures whilst also being considered within relevant risk management processes where they may affect objectives, service delivery, resilience or statutory responsibilities.

3.4 Continuous Improvement

All employees, managers and governance bodies have a role in supporting continual improvement. Continual improvement is an integral part of the Risk Management Framework, supporting the ongoing development of risk management arrangements, Council resilience and informed decision-making.

3.5 Risk Categories

To support a consistent and comprehensive approach to risk management, risks should be identified, assessed, managed and monitored across a range of categories. These categories provide a framework for understanding and managing risks that may affect the achievement of objectives, service delivery and statutory responsibilities.

Risks are often interconnected and may affect multiple areas of activity. Risk assessments should therefore consider both direct and indirect impacts, including potential cross-cutting consequences.

The principal risk categories are:

• Strategic Risks – Risks that may affect the achievement of long-term vision, strategic priorities and organisational objectives.
• Operational Risks – Risks arising from service delivery, activities, processes, systems and day-to-day operations.
• Financial Risks – Risks that may impact financial sustainability, resource management, budgets or financial performance.
• Compliance Risks – Risks arising from failure to comply with legal, regulatory, statutory, policy or contractual requirements.
• Reputational Risks – Risks that may affect public confidence, stakeholder trust or organisational reputation.
• Information and Cyber Risks – Risks relating to the security, integrity, availability and management of information, data and digital systems.
• Environmental and Climate Risks – Risks associated with environmental impacts, climate change, sustainability challenges and environmental obligations.
• Partnership Risks – Risks arising from relationships with external organisations, suppliers, contractors and partnership arrangements.
• Resilience Risks – Risks that may affect preparedness for, response to, recovery from and adaptation to emergencies or disruptive events.
• Emerging Risks – New, developing or uncertain risks that may have a significant future impact on objectives, services or communities.

Detailed arrangements for the identification, assessment and management of these risk categories are set out within the supporting Risk Management Framework and Guidance documents.

Interrelationship of Risk Categories

Risks rarely occur in isolation and may have consequences across several areas simultaneously. When assessing risks, Risk Owners should consider interdependencies, cumulative impacts and wider organisational implications to ensure that risks are evaluated and managed holistically.

The risk categories outlined above provide a common framework for the identification, assessment, reporting and management of risk across the Council and support a consistent approach to corporate governance, resilience and continuous improvement.

4. Governance Structure and Responsibilites

4.1 Structure

The risk management framework is supported by a clear governance structure that establishes accountability, oversight, assurance and responsibility for the management of risk. Effective governance supports the identification, assessment, management and escalation of risks while providing assurance that risk management arrangements contribute to informed decision-making, organisational resilience and the achievement of objectives.

The governance structure outlined below demonstrates how risk management responsibilities are distributed throughout the Council, ensuring that risks are managed at the appropriate level, with strategic oversight, challenge and scrutiny provided through established governance arrangements.

IMAGE: The “Governance and Accountability Framework” diagram places the OIC Risk Management Framework at the centre, with “Governance”, “Accountability”, “Assurance” and “Service Delivery” identified within it. The surrounding governance roles are Council Committees, Chief Executive, Corporate Leadership Team, Directors, Heads of Service, Risk Owners / Managers and Employees. The outer framework identifies Continuous Improvement, Escalation, Monitoring and Risk Reporting. A note states: “Risks should be managed at the lowest appropriate level and escalated where wider oversight is required.”

4.2 Responsibilities

Effective risk management relies on clear governance arrangements, defined accountability and effective oversight at all levels of the Council. Responsibility for managing risk is shared across the organisation, with specific roles providing leadership, assurance, scrutiny and operational risk management. The governance responsibilities outlined below support the effective implementation of this Policy and Strategy.

Summary of Responsibilities

• Committees responsible for governance and risk management
  Provide strategic oversight, scrutiny and assurance of significant risks and risk management arrangements.

• Chief Executive
  Holds overall accountability for the effectiveness of the Risk Management Framework. This includes ensuring that risk management remains aligned with Council priorities, governance requirements and strategic objectives.

• Corporate Leadership Team
  Maintains oversight of the corporate risk profile and strategic risk management arrangements. The team reviews and monitors corporate and emerging risks, ensures appropriate mitigation measures are in place, and supports escalation of significant risks where required.

• Directors
  Ensure that risk management is embedded within Directorate planning, decision-making and service delivery. Directors are responsible for ensuring risks within their Directorates are identified, assessed, managed and reported, and for obtaining assurance that controls and mitigation measures remain effective.

• Heads of Service
  Oversee service-level risks and ensure that appropriate controls and mitigation measures are implemented and monitored. Heads of Service are responsible for maintaining Service Risk Registers, supporting the review of Directorate Risk Registers, and ensuring that significant risks are escalated through the appropriate governance arrangements where necessary.

• Service Managers
  Support the effective management of service and operational risks by ensuring that risks are identified, assessed, monitored and controlled within their areas of responsibility. They are responsible for maintaining local risk information, implementing mitigation measures and escalating significant risks where appropriate.

• Risk Owners
  Manage assigned risks and ensure that controls and mitigation measures remain effective. They are responsible for monitoring risk exposure and reporting significant changes through the appropriate governance arrangements. Risk Owners should ensure that risk information remains accurate, up to date and regularly reviewed to support informed decision-making and the effective management of risk.

• Safety and Resilience Service
  Provides professional advice, guidance and coordination to support implementation of the Risk Management Framework. The Service also promotes consistency, good practice and continual improvement across risk management arrangements.

• Internal Audit Service
  Provides independent assurance regarding the effectiveness of governance, risk management and internal control arrangements. Audit findings and recommendations support ongoing improvement and Council learning.

• Employees
  Identify and report risks, follow established controls and contribute to a positive risk culture and robust risk management. Employees play an important role in supporting risk awareness and ensuring that emerging concerns are identified at an early stage. Timely reporting and effective communication of risks help ensure that issues are addressed appropriately and escalated where necessary.

Accountability

Risk management is a shared responsibility supported by clear accountability, effective oversight and timely escalation. Risks should be managed at the lowest appropriate level and escalated where their significance, impact or complexity requires wider management or governance oversight. This approach helps ensure that resources, expertise and decision-making are applied at the appropriate level to support the achievement of organisational objectives.

5. Oversight

Effective risk management requires appropriate assurance, monitoring and reporting arrangements to provide confidence that risks are being identified, assessed, managed and reviewed effectively. The Risk Management Framework is informed by the principles of the Institute of Internal Auditors' Three Lines Model, which distinguishes between operational risk ownership, oversight and support functions, and independent assurance. This approach helps clarify responsibilities for risk ownership, monitoring and assurance while supporting informed decision-making and continual improvement.

5.1 Assurance

Three Lines Model

First Line: Risk Ownership and Management

Directors, Heads of Service, Service Managers, Risk Owners and employees form the First Line of the assurance framework. They are responsible for identifying, assessing, managing and monitoring risks within their areas of responsibility. Directors provide strategic oversight and accountability, while operational managers and staff undertake the day-to-day management of risks.

Responsibilities include:

• Identifying, assessing and managing risks within areas of responsibility.
• Implementing and maintaining appropriate controls and mitigation measures.
• Monitoring risk exposure and control effectiveness.
• Escalating significant risks through the appropriate management and governance arrangements.
• Supporting the effective delivery of services, projects and strategic objectives.

Risk management should form an integral part of planning, decision-making and service delivery activities.

Second Line: Oversight and Support

The Second Line provides advice, guidance, oversight and monitoring to support effective risk management. It includes the Safety and Resilience Service and other corporate and Directorate Support functions, which help ensure the consistent application of the Risk Management Framework, provide specialist advice, support risk reporting and monitoring, and offer appropriate challenge and assurance to management.

This may include:

• Health and Safety.
• Resilience.
• Information Governance.
• Business Continuity.
• Finance.
• Human Resources.
• Procurement.
• Legal Services.
• ICT and Cyber Security.
• Corporate Performance and Improvement.

These functions support the effective operation of the Risk Management Framework through the development of policies, guidance, training, compliance monitoring and assurance activities. Responsibility for managing risks remains with the relevant risk owner.

Third Line: Independent Assurance

Internal Audit provides independent and objective assurance regarding the effectiveness of governance, risk management and internal control arrangements.

Internal Audit reviews the operation of the Risk Management Framework and provides assurance to senior management and committees responsible for governance and audit regarding the adequacy and effectiveness of risk management arrangements.

5.2 Monitoring

Risks will be monitored through a range of governance, management and assurance activities to ensure that risk exposures, controls and mitigation measures remain effective.

• Corporate Risk Register – The Corporate Leadership Team will maintain oversight of the Corporate Risk Register, ensuring that strategic and corporate risks are appropriately reviewed, managed and escalated where necessary. Corporate risks will be reported through the appropriate governance arrangements.

• Directorate Risk Registers – Directors are responsible for maintaining and reviewing Directorate Risk Registers, with support from Heads of Service, to ensure that risks affecting the delivery of directorate and service objectives are identified, assessed, managed and escalated where appropriate. Directorate Risk Registers provide oversight of significant operational and strategic risks, ensure that control measures and mitigation actions remain effective and proportionate, and support the escalation of risks to the Corporate Risk Register where necessary.

• Service Risk Registers – Service Managers, Heads of Service and Risk Owners may maintain Service Risk Registers where appropriate to support the management of operational and service-level risks. Risks, controls and mitigation actions should be reviewed regularly to ensure they remain effective and up to date, with significant risks escalated through Directorate Risk Registers and, where necessary, to the Corporate Risk Register.

• Other Risk Registers – Additional risk registers may be maintained where required to support effective risk management, including Project Risk Registers, Programme Risk Registers, Partnership Risk Registers and other specialist risk registers. The responsible manager or risk owner must ensure that risks are regularly reviewed and escalated through the appropriate governance arrangements where necessary.

• Committee Reporting - Committees with responsibility for governance and risk management will receive periodic reports to provide assurance regarding the effectiveness of risk management arrangements and the management of significant risks.

• Internal Audit - Internal Audit will provide independent assurance on the effectiveness of governance, risk management and internal controls and will identify opportunities for improvement where appropriate.

• External Scrutiny - Regulators, inspectors and external auditors may provide additional assurance regarding the effectiveness of governance, risk management and organisational resilience arrangements. Findings and recommendations arising from external scrutiny will be used to support continual improvement. While these bodies do not form part of the council's risk management structure, they provide an important source of assurance and challenge.

• Training and Awareness - Effective risk management depends upon a risk-aware workforce and informed decision-makers. Appropriate training, guidance and awareness activities will be supported to ensure that employees, managers and Risk Owners understand their responsibilities and can contribute effectively to the identification, management and escalation of risk. Training may be delivered through induction, briefings, workshops, e-learning, guidance materials and service-specific arrangements, as appropriate. Managers are responsible for ensuring that relevant staff have access to the knowledge and skills required to fulfil their risk management responsibilities. Risk awareness will be promoted through ongoing communication and engagement activities to support a positive risk culture.

5.3 Escalation

Risks should be managed at the lowest appropriate level, with ownership and accountability clearly assigned. Where the impact, complexity, significance or potential consequences of a risk exceed local management arrangements, it should be escalated through the appropriate governance structure to ensure that suitable oversight, resources and decision-making are applied.

The Risk Escalation Framework below provides a structured approach for escalating risks from Service Risk Registers, Project Risk Registers, Programme Risk Registers, Partnership Risk Registers and other specialist risk registers through Directorate Risk Registers and, where necessary, to the Corporate Risk Register. This ensures that significant risks receive appropriate management attention, oversight, scrutiny and assurance. The framework supports consistent decision-making by ensuring that risks are considered at the most appropriate level within the council and that escalation is proportionate to the nature and significance of the risk. It also facilitates effective communication and reporting of risks, enabling visibility of emerging issues and risks that may affect the achievement of corporate, directorate or service objectives.

IMAGE: The “Risk Escalation Framework” diagram shows increasing impact, increasing complexity and increasing strategic significance leading upward through risk registers. Service Risk Registers cover operational and service-level risks and are maintained by Service Managers, Heads of Service and Risk Owners. Other Risk Registers include Project Risk Registers, Programme Risk Registers, Partnership Risk Registers and Specialist Risk Registers, managed by the responsible manager or risk owner. These feed through escalation to Directorate Risk Registers, which contain significant operational and strategic risks and are maintained by Directors with support from Heads of Service. Further escalation leads to the Corporate Risk Register, containing strategic and corporate risks under the oversight of the Corporate Leadership Team. A note states: “Risks should be managed at the lowest appropriate level and escalated where wider oversight, resources or strategic action are required.”

5.4 Review

This Policy and Strategy will be reviewed at least every three years, or sooner where significant legislative, regulatory, organisational, financial, technological or operational changes occur. The effectiveness of the Risk Management Framework will be monitored through established governance, management and assurance arrangements, including risk register reviews, performance and governance reporting, management oversight, committee scrutiny, internal audit activity and, where applicable, external inspections and assurance reviews. with lessons identified from incidents, audits, exercises, investigations, reviews and assurance activities used to support continual improvement, strengthen Council resilience and inform decision-making.

6. Appendices

Appendix 1: Risk Management Framework and Process

This Policy and Strategy is supported by the following documents:

Risk Management Framework and Guidance – Provides operational guidance on risk management arrangements, including risk escalation, risk registers, review frequencies, assurance arrangements, and detailed roles and responsibilities.

Risk Assessment Guidance – Provides the Council's approved approach to risk assessment, including the 5x5 risk matrix, risk scoring methodology, risk appetite and tolerance thresholds.

Together, these documents provide the policy, framework and practical tools required to support effective risk management across the Council.