Question

Is a small PC required to have a Risk Management Strategy and if so, must it be published and reviewed annually?

Many thanks.

Sam

Answer 1

On the Annual Governance Statement of the AGAR form you must certify that:

"We carried out an assessment of the risks facing this authority and took appropriate steps to manage those risks, including the introduction of internal controls and/or external insurance cover where required."

The explanation of this question is:

"The authority considered and documented the financial and other risks it faces and dealt with them properly."

The Internal Auditor must certify that:

"This authority assessed the significant risks to achieving its objectives and reviewed the adequacy of arrangements to manage these."

Comments

Many thanks DtC.

Answer 2

Strictly speaking no. A risk management strategy is not the same thing as a risk assessment. A strategy would set out a broad plan about how a council would assess risk and set out who carries out the risk assessments. It might also include what council operations would be subject to risk assessments, and cover  items like insurance, business continuity plans, putting in place backup servers etc

Comments

Thank you Graeme_r.