By Lancing Farrell                                                                                                  730 words

Image

Is there a delegation for taking risks at your council? Does your council have a risk appetite? Are the strategic risks that have been identified appropriate? Are the operational risks relevant? Does the audit program decrease or increase risk?

These are questions that a colleague raised with me recently when trying to understand the way risks were managed at their council. I suggested they look at their risk management framework – how is risk assessed in terms of likelihood and consequence. This should explain the inherent risk, current risk rating, the target risk and rate the effectiveness of controls. It can make interesting reading.

Next, I suggested they look for their organisations lists of key risks – strategic and operational. These are usually in the risk register. This isn’t always easy to find. Someone in the risk department will have it. Most councils will have up to 8-12 strategic risks. There will be many more operational risks.

Councils are very risk aware. Some people describe it as risk aversion. I think this is driven by the multiple accountabilities that councils live with – the Minister for Local Government, the Ombudsman, the courts, the media and the community. Sometimes it is hard to know who is going to take issue with what you have done.

Then I suggested they might look at the charter for their Audit and Risk Committee (ARC). In Victoria, each council must have an ARC that includes officers, councillors and independent members. It provides advice to the council and oversees external and internal audit programs. Its work should be influenced by the organisation’s identification and management of risks.

Internal audits are intended to determine whether controls are in place for identified risks, that controls are being followed, and that they are effective in ensuring that risks are at the level the organisation intends – i.e. the level of residual risk that the organisation is comfortable to have.

The effectiveness of these audits depends on the quality of the risk management framework, how well risks have been identified, and the level of risk the council wants to have. Unless this is done well, you may end up with a list of actions arising from the audits that distract you from seeing the real risks in what you are doing.

Lastly, I suggested they look for the level of risk the organisation will accept. This turned out to be the most interesting part. They discovered their organisational risk appetite statement.   It categorised risks into three categories – low, medium and high.

‘Low’ risk meant zero or no appetite with strong controls in place to eliminate risk. ‘Medium’ risk meant some risk could be taken with effective controls in place to limit it. It was clearly intended to allow some risk to be taken in balance with prevention and mitigation controls. The most interesting category was ‘high’ risk. This category allowed risks to be taken to pursue value creating opportunities. Fewer preventative or mitigating controls are required.

The million-dollar question was what risks were in each category and how many were in the ‘high’ category?

Unsurprisingly, compliance, OHS and corruption were in the ‘low’ category. Councils don’t like to get into trouble and the safety and well-being of people is justifiably important. The ‘medium’ category included all other strategic, operational and project activities. The ‘high’ risk column was empty.

I am sure this is not an uncommon situation. Why would a council take risks to create value? I once heard a senior public servant say that the public service tends to plan not to fail (i.e. this is more important than planning to create value). In doing so, it chooses not to take risks. He said this was perfectly understandable because we are often punished unfairly by those we are accountable to when we take risks that don’t come off. The price you pay for failure is much higher than any reward for success.

This creates an interesting dynamic for councils in an environment where the State government imposes a rate cap to limit council revenue, there is unprecedented residential growth (Melbourne is the fastest growing city in Australia with over 100,000 people arriving in 2017), and residents’ expectations of service personalisation, choice and convenience are increasing.

Councils are being forced to address challenges that require them to do something different. Something new. Something risky.