Official Sensitive

Mark Ripley, Kay McNeil,Jo CollinsWhat makes good risk management?

Our objectives

A high performing and diverse function, with great people in the right roles with

the right skills

A modern, collaborative

finance function that delivers quality services more effectively and

efficiently

An informed function, with a

clear understanding of what we get for our money, using insight to drive value for money

The ‘go-to’ advisor for colleagues to provide expert

advice and informed decision

making

Driving a strong culture of planning, risk & performance

with integrated financial and business planning, aligned with

robust risk and assurance

People &

capability

Operating

model

Insight Trusted

advisor

Planning, risk

& performance2 3 4 5 6Standards & policies,

guidance and best practice e.g. good

forecasting, reporting, robust data, efficient

transaction processing, management of risk

Getting the

basics right1

Session outline• Risk management principles - The Orange Book• Integrating our insight and understanding:

• HMRC - Joining together the work of risk, performance, assurance practitioners and finance business partners

• MoJ - How we are making this work in practice to improve strategic insight over principal risks

• What capabilities do we need?

The Orange BookIn 2001, HM Treasury produced the Orange Book, which introduced the basic concepts of risk management. This was enhanced in 2004. Today, the ability to deliver effective and meaningful risk management and assurance - fully integrated and embedded into collaborative, routine ways of working - is more important than ever.We are leveraging professional and technical/specialist guidelines, steered by risk management experts within and external to government, to create an updated and expanded Orange Book, with the aim of creating a foundation to:• Develop a culture and processes in which risks are considered

proactively in the planning and delivery of every activity and are managed and monitored by those best placed to do so;

• Align other central government functional standards, guidance and good practice principles, frameworks and processes; and

• Consider the basis to synchronise cross-governmental risk and assurance insights, where appropriate.

Risk Management PrinciplesRisk management should be:

• an essential part of governance and leadership, and fundamental to how the organisation is directed, managed and controlled at all levels.

• customised and proportionate to the organisation’s external and internal context and dynamic to change.

• an integral part of all organisational activities to support decision-making in achieving objectives and should continually contribute to the improvement of management systems.

• inclusive and comprehensive in covering all areas and perspectives.

• structured, based on a robust risk management framework and good practice processes and informed by the best available information,

• be continually improved through learning and experience.

How have HMRC been improving risk management• Enhancing risk work• Merging risk and performance reporting roles• Learning catalogue for risk and performance • Bespoke training design collaborating and utilising business expertise• Roll out across HMRC (risk/performance/FBPs/Planning/others)• Working with GFA for x-Government FBPs training

Group exerciseReview the material provided and note down your thoughts:

• What might the impacts on performance be?• What do you think the risks are ?• What other budget information would you want to see?

• What would you be saying to the CEO of GPA?

The relationship between finance, performance and risk

RiskPerformance

More informed decision-making

Finance

MoJ: the story so far• We have changed our reporting over the last year to better integrate

performance, risk and assurance information moving from a traditional risk areas to principal risk dashboards

• The team has needed to change to deliver this approach:• Moved away from being a reporting function to one that business partners and assists

units to manage their risks• Provides more advice, guidance, training, coaching etc to upskill the business

12

5

4

3

2

321

1

4 5

Likelihood

Impa

ct

1

13

15

16

Departmental risk register overview October 2018

17

19

Ref Risk Area Risk Description Risk Owner /Trend

1 Funding Failure to prioritise and plan effectively to deliver a balanced budget leading to foreseeable/avoidable overspends

2

People

Failure to undertake effective workforce planning

3 Failure to develop effective leaders across the organisation

4 Failure to define and build the capability required for the future

5 Information management, security and technology

Failure to replace obsolete systems, out of support systems that are vulnerable to attack and deliver appropriate business led technology

6Failure to meet our statutory duties in relation to data

7

Demand

Failure to effectively manage demand and supply for prison places

8Unable to manage public and private family law pressures

9 Failure to plan effectively for system wide spikes in demand

10

Commercial

Failure to define and shape the services we wish to procure

11 Lack of clarity over the business requirement prior to commencing procurement.

12 Failure to effectively manage our supply base

13 Change Failure to deliver the intended benefits of HMCTS reform to time, budget and quality

14 Stakeholder engagement

End to end thinking and partnerships across the justice system are not sufficiently developed

15 Breakdown in judicial relationship

16EU exit

Failure to secure MoJ priorities in EU exit negotiations

17 Downstream impacts of EU exit will adversely affect the MoJ's ability to deliver core services

18

Delivery

Unable to improve safety in prisons leading to violence, injuries, self-harm and death

19Custodial living areas and working conditions fail to meet acceptable internal and external decency standards and/or legal safety standards

20 Breakdown in employee relations with prison staff leading to local and/or national strike action

21 CRCs have insufficient resources to fulfil their contract obligations which may result in poor quality service or failure

2 3 8

7 1820 21

Scores TBA:

9

14

5

64

111012

Funding Risk sponsor – Mike Driver Risk lead – James McEwen

Secondary risks Score/Trend

Failure to prioritise and plan effectively to deliver a balanced budget leading to foreseeable/avoidable overspends

4/4 Despite best efforts this year to mitigate the stress on the MoJ budget, it is not expected that activity, including the current H2A process, will reveal a credible plan to live within existing control totals in 18/19 or 19/20. As such our focus is on continuing to have constructive conversations with HMT towards securing further funding in theSupplementary estimate. Going forward, our focus is on preparing effectively for the Spending Review to reset our finances. Our ambition should be to set a budget which has a realistic prospect of allowing the department to manage risk and opportunities without recourse to reserve funding.

Trend

No change

1. FYF Overspend: before & after potential additional HMT Funding

Key control/ activities

What effect is the control having on the risk? Criticality

Effectiveness

HMT relationship building

We are engaging HMT and giving them advanced notice of financial challenges to demonstrate the difficulties we face and the actions we are taking to manage these. As a result our credibility with HMT is growing but acknowledge this requires a lot of continuing work.

3

In-year financial controls / Business Partnering

Monthly review meetings held with business groups to challenge assumptions and changes. At P4, of a £170m adverse movement, £160m had previously been flaggedCurrently conducting a series of holding to account meetings between Permanent Secretary and DGs, to test the application of existing controls and to identify opportunities for saving.

3

Financial Risk Management

Currently only reported on a short term time margin. Lot of work been done to work with Groups to improve quality of data. But, acknowledge this is still work in progress especially at a multi-year level and need to get it into a position where we can drive clear risk / reward discussions at FMC and ExCo.

3

Future year planning / forecasting

Departmental planning processes increasing in maturity, but we acknowledge we need to improve how we prioritise and make active choices to live within our means across the full spectrum of MOJ priorities.We are looking at 19/20 spending plans earlier than we have in previous years to better understand our options, but acknowledge that the profiles extending into the next SR are less robust and more in-depth planning is required.

3

Other stakeholder engagement

Implementing a programme of communication activity including intranet blogs, SLG and ExCo.2

CRO Assessment:Given the MoJ’s current financial position, in essence the risk causes have crystallised and we now need to efficiently manage impact, particularly through work to improve our standing with HM Treasury. There is evidence from the finance team that engagement with this risk is strong with good engagement from DG’s in the current H2A meetings, and more constructive conversations with HMT leading up to the Supplementary estimate. Going forward there is significant effort needed to improve the effectiveness of medium term planning, including building a strong evidence base in preparation for SR19, and tightening financial controls, multi-year financial risk/opportunities management and ensuring consistency in the MoJ financial culture. The results of the Cabinet Office planning maturity assessment will be a good baseline for moving forward.

2. Comparison - Net Financial Risks and Opportunities Heatmap (Likelihood: Risk – Red; Opportunities - Green)

Period 4 Period 5

Internal Audit reports

Requisition to Pay (Follow Up) Limited (17/18) Digitech Investment Scoping/Fieldwork

Financial Allocations Scoping/Fieldwork Framework of Delegations Limited (17/18)

Fees and Income Moderate (17/18) Manual Finance Processes Limited (17/18)

Our financial position requires significant HMT support if we are to avoid an excess vote. We are actively working with HMT to manage the risk that they are unable or unwilling to support us

It is critical that we remain focused on further mitigating down the potential risks in 18/19, and realising opportunities. Further senior attention on these issues is likely to be required to best manage the overall position. The Holding to Account process has shown there is a better focus on controlling spend, however there is more work to be done to ensure consistency of financial culture.

Agreed amounts: HMCTS ReformOPG Fee refundsBrexit funding

The in-year switch islargely within ourdiscretion and subjectto addressing our CDELpressures.

Note: any remaining P5 FRDELforecast overspend will need tobe mitigated away alongsidec.£300m of risks net of a smallnumber of opportunities.

Ʃ £960m, Public Sector Net Borrowing Requirement related ask of HMT

New pressures: LAA; Prisons incl. pay; GFSL; ET fee refunds; Judicial pay; Loss of fee income

To be agreed:Probate

Last Update: 26/09/2018 OFFICIAL - SENSITIVE

Skills and capabilities• Need to build understanding and to foster effective partnerships across the finance

function and with other functions and professions.• We will:

• introduce success profiles for risk and assurance that will define behavioural and technical competencies and strengths needed for risk practitioners and links to other roles that require an awareness of risk and assurance principles and practices.

• Ensure alignment with other finance disciplines, including finance business partners, and other functional areas, such as project delivery, commercial, security, etc.

• Make recommendations on learning and development and career pathways.

• Common need for business partnering skills and experience, e.g. communication, influencing, negotiation, analysis, collaboration, etc.