Agenda item

The purpose of this report is to provide members of the Audit Committee with an update on risk management across the Council.

David Hughes (Director of Audit, Fraud, Risk and Insurance) briefed the Committee on the Risk Management Update and Corporate Risk Register 2024/25. He highlighted the increase or reduction in risk scores and the addition of three new risks (page 75). He further noted that the Risk Register had been reviewed by the SLT Assurance which suggested the narratives for each risk be focused on the current arrangements and mitigation plans. Going forward, lead directors/risk owners might attend committee meetings and report the outcomes of the arrangements and any changes to the planned actions.  Members might deep dive a particular risk to make sure it was maintained or reduced. David added an update on risk management arrangements on cyber security would be presented at the June meeting.

Jules Binney added that the Risk Register was under evolution where the risk narratives were outlined with specific mitigations making them easier to understand. A new Risk Register with defined actions and responsibilities taken by the risk owners would soon be rolled out after testing.  While reducing the number of risks was preferential (like the dropping of the risk relating to the Hammersmith Bridge because it no longer held a systemic risk to the Council), the Council had to live with some risks such as cyber security because cyber-attacks would continue to happen regularly. 

Believing the risk related to cyber security had to remain “Red” in future, Councillor Lisa Homan observed that the risk relating to the management of complaints, requests for information, members enquiries (risk no. 18) should be resolved soon and show progress from “Red”. David Hughes acknowledged her observation as the SLT Assurance was leading actions in that direction.  He undertook to provide more assurance by bringing a more detailed report on this to a future meeting.

ACTION: David Hughes

On Councillor Homan’s concern about the progress of any risk escalating from “Yellow” to “Red”, David Hughes said the financial management and medium-term planning (risk no. 19) had been a key focus for the S151 Officer and the Cabinet Member for Finance and Reform. While a lot of good work had been done to bring a balanced in-year budget, the position of the Medium-term Financial Strategy (MTFS) at H&F, like that of many other authorities, was becoming increasingly challenging.

Councillor Florian Chevoppe-Verdier recalled this Committee had agreed to the recommendations of having more risks while adopting the approach of risk ownership. Referring to the risk of failure to comply with the new Building Safety Act and certification of 49 Higher Risk Buildings (HRBs) (risk no. 10), he asked if this was a one-time thing or an annual exercise and whether the Building Safety Managers recruited for the purpose could meet the workload to certify the remaining 23 HRBs.

David Hughes noted that local authorities were required to register HRBs by September 2024. The Building Safety Regulator (BSR) had invited H&F in January this year to certify 26 of its 49 HRBs. The building safety cases involved very detailed submissions around construction and safety arrangements for individual HRBs which included outcomes of residents’ consultation. The Council had received 25 to 30 BSR’s questions per building, much fewer than 100 to 150 for building safety cases in some other authorities.  H&F had also made quality submissions and responded to the regulator’s time-dependent legal requests. The BSR was meant to review, respond and certify the 26 HRBs within a reasonable timeframe but they were reviewing several hundreds of building safety cases across London. The capacity of the BSR became a mutual concern among the network of London housing directors and some developers as some 100,000 new homes were being delayed awaiting to complete the BSR process.  He highlighted the three Building Safety Managers in H&F were responsible for maintaining building safety cases throughout the building life and made submissions to BSR on risk-assessment basis.  David remarked resources were there to ensure all building safety cases were maintained. 

Councillor Lisa Homan considered it a serious issue for BSR being unable to catch up with the building safety cases. Councillor Chevoppe-Verdier noted there was a chronic understaffing of regulators across the board, with some teams needed to deal with hundreds of cases by 10 staff.

David Hughes pointed out that the Grenfell Tower Inquiry Report had recommended the central government to re-assess the definition of HRBs and change it from the present over 18 meters high or 7 storeys to 11 meters and above. If adopted, this would create more building safety cases for the BSR to review.  He confirmed that the 49 HRBs did not include private HRBs which had its own mechanism to ensure building safety and the Council did not have responsibility for this.  David agreed to provide further information on HRBs owned privately or by Housing Associations and the Council’s powers and enforcement over their building safety.

ACTION: David Hughes

Councillor David Morton noted some buildings in his ward had started building safety certification works but never finished. He also noted the loophole that the building safety officers were self-employed with some being the contractors themselves.  He had received residents’ complaints about the lack of building safety control, but the Council had no way of enforcement.

David Hughes considered the specific situations quite concerning.  As the functions of building control covered dangerous structures, he said the building control team would be able to advise the way forward. 

RESOLVED

The Committee agreed to note the report.