The Annual Register Ritual
Bracken District Council has had a risk management framework for six years. The corporate risk register is reviewed once a year before the audit committee; service risk registers are updated only when someone remembers. Internal audit has just reported that many entries are copied year to year, 40% of risks have no named owner, and staff describe risk management as 'something finance does'. Risk training is mandatory at induction but there is no refresher. Risk appears on the audit committee agenda but not in service management team meetings or in reports to the cabinet. The new monitoring officer wants to embed risk management before the external audit in nine months. There is no budget for new software, but performance clinics and service management team meetings already exist and could be used. The chief executive is supportive but has limited time.
1. Using the evidence, assess how far risk management is embedded at Bracken Council. Refer to the embedding and reviewing factors that are missing.
Read the worked answer
Assessment of embedding
The evidence points to compliance ritual rather than embedded risk management. The annual review cycle, copied entries and missing owners show that the register is maintained for audit, not used for decisions. Staff see risk as 'something finance does', which indicates a culture and communication gap. Risk is absent from service management meetings and cabinet reports, so it is not integrated into governance or decision-making. Training stops at induction, so managers lack refresher capability. The audit committee sees risk, but the body that takes service decisions does not.
Missing embedding and reviewing factors
- Visible leadership: the chief executive is supportive but not visibly sponsoring risk in service meetings.
- Ownership and accountability: 40% of risks have no named owner, so no one is accountable for response.
- Integration with decision-making: no risk input to cabinet reports or performance clinics.
- Capability: no refresher training or practical guidance for managers.
- Performance management: no link between risk responsibilities and objectives or appraisals.
- Review and challenge: annual review is too infrequent; there is no evidence of challenge or health-checking.
- Communication and culture: risk language is finance-owned, not service-owned.
A framework can exist for six years without being embedded. The test is whether managers use risk information when they make decisions, not whether a register exists.
2. Design a nine-month embedding plan that uses existing meetings and no new software. How would you measure progress?
Read the worked answer
Nine-month plan
Months 1-2 - Leadership and ownership. The chief executive and monitoring officer issue a short statement that risk is a service responsibility. Assign named owners to all corporate and service risks. Add a standing risk item to service management team meetings using a one-page template linked to the performance clinic.
Months 3-4 - Capability and integration. Run practical refresher sessions for managers using their own risks. Introduce a short risk section in cabinet and committee reports, with escalation criteria. Start quarterly deep-dive reviews on the top corporate risks.
Months 5-6 - Refresh and challenge. Refresh service registers with owners, review dates and evidence. Establish a small risk champion network. Run an internal audit dry run and test the escalation route with a live service issue.
Months 7-9 - Sustain and evidence. Include risk responsibilities in senior managers' objectives. Publish a simple dashboard. Prepare the external audit evidence pack and confirm the review cycle.
Measures
- Percentage of risks with a named owner and a current review date.
- Percentage of service management meetings with risk minutes.
- Percentage of cabinet reports containing a risk section.
- Number of risks escalated and actions closed.
- Staff survey shift from 'finance does risk' to 'my service manages risk'.
- Internal audit findings repeated or cleared.
I would avoid new software, a big-bang training programme, and rewriting every register at once; those consume capacity without changing behaviour.