Agenda item

Report of the Chief Strategy Officer.

The Committee received a report of the Chief Strategy Officer concerning an update on the corporate and top red departmental risk registers since they were last reported to the Committee in February 2025.

The following points were noted:

• The Chief Strategy Officer introduced the item and key officers supporting the risk update, highlighting a shift toward proactive, enabling risk management and a stronger organisational risk culture.
• The Chief Officer Risk Management Group continues to coordinate risk oversight across departments and institutions, with a focus on trend analysis and organisational-level risks.
• Members received the full corporate risk register and were informed that future reporting will align with the new risk appetite framework, pending Court of Common Council approval.
• Members suggested improvements to reporting clarity, for terminology and inclusion of target risk levels on summary pages.
• CR16 (Information Security) remains the highest-rated risk. Improvements include 24/7 monitoring and mandatory training. The information management risk has decreased due to improved GDPR compliance.
• Ransomware was raised as a concern and will be addressed further in the non-public session. Recruitment for a Chief Information Security Officer is underway.
• Funding constraints were discussed in relation to risk mitigation. Officers confirmed that resource availability is being reviewed as part of risk assessments.
• The Medium-Term Financial Plan shows City Fund is currently balanced, but future deficits are forecast due to the 2026 business rate reset. City’s Estate is in a stronger position following the decision not to relocate markets.
• Internal audit findings on procurement compliance highlighted areas for improvement. Further guidance and training are being developed.
• The Housing Revenue Account (HRA) remains under pressure due to rent caps and repair backlogs. An audit of rent arrears is planned, and national advocacy is ongoing.
• Members suggested highlighting upward-trending risks in future reports to ensure appropriate scrutiny. Officers agreed to take this forward.

RESOLVED – That, the report be noted.