Risk Management Policy
February 2024
Risk Management Policy
February 2024
Contents
Page
Summary 3
a. Introduction and Objectives 3
c. Roles and Responsibilities 4
b. Monitoring and Reporting 10
c. Conclusions 11
This framework sets out the East Sussex Pension Fund policy on risk management and its strategy for the effective identification, assessment and, where appropriate, management of risks.
The key objective of the Administering Authority is to effectively run the Pension Fund, paying benefits as they fall due. This policy is intended to allow for the identification and effective mitigation of risks that may undermine the Administering Authority’s ability to do so.
There are many definitions of ‘risk’ and ‘risk management’. In simplest terms, these can be defined as follows:
· Risk - ‘the probability of an event occurring and its consequences’;
· Risk management - ‘the processes and structures to enable the effective management of potential opportunities and the elimination / reduction of threats’.
Risk is unavoidable and effective risk management is not about the elimination of risk. The Administering Authority’s ability to manage risk effectively and proportionately, and maximise opportunity, plays a crucial role in its ability to achieve the key objective.
Risk management is not simply a compliance issue but is a decision-making tool, utilised at both strategic and operational levels, and is an essential element of effective governance.
In developing this framework, the Administering Authority recognises that risks cannot be fully managed and that, in being more innovative, efficient and effective, it may choose to take and/or accept more risk. Where this is the case, robust risk management practice will help ensure that the Administering Authority takes appropriately informed decisions, having properly evaluated the potential risks and the associated opportunities.
The Administering Authority, also known as the Scheme Manager, is responsible for the operation of the Fund. In practice this role is delegated to the Pension Committee (the Committee).
The Committee meets each quarter and should consider the existing risk register at each meeting, together with the recommendations by Officers or the Local Pension Board with proposed changes. The Committee should also consider whether it would like any additional risks to be considered or for existing risks to be removed from the risk register.
As part of the quarterly meetings it would be appropriate for the Committee to consider those risks subject to possible change, the most significant risks and a selection of the other risks on the risk register.
At least annually, the Committee should review the risk register in its entirety.
The role of the Local Pension Board (the Board) is to support the Administering Authority. The knowledge and understanding requirements set out in legislation apply to the Board.
The Board meets each quarter, shortly before the Committee. At each meeting it should consider the risk register with a focus on the most significant risks and any changes recommended by Officers. Additionally, the Board should consider a sample of other risks and make suggestions where it feels changes to the risk register should be made. Minutes of the Board meetings are reviewed at the start of each Committee meeting to take comments and recommendations into account within its decision making.
The Board should consider the risk register in its entirety at least annually. This review should be timetabled to reflect the timing when the Committee will also be fully reviewing the risk register.
From time to time a Working Group will be formed to consider a particular issue. It is likely such a Working Group will include representatives from the Committee, Board along with support from Officers.
The scheduling of meetings will vary depending on the issue to be considered. However, at each meeting relevant risks on the risk register should be considered. A report on the Working Group’s findings should be presented to the full Board and Committee at their next, quarterly, meeting.
As part of this process suggestions for changes to the risk register should be made as appropriate.
Fund Officers (Officers) carry out the day to day tasks required for the operation of the Fund. This is done in line with the instructions provided by the Committee.
Officers are most closely associated with the Fund operations and are most likely to identify trends and potential risks. Additionally, Officers will be responsible for the mitigation tasks in the risk register.
Before each meeting Officers should consider whether any changes need to be made to the risk register. This may include adding/removing a risk, changing listed mitigations, or rescoring a risk.
At various levels, people associated with the Fund receive advice from third party advisors. This includes, but is not limited to, the Fund Actuary, Investment Consultants and the Committee’s Independent Advisor.
Third party providers may identify emerging risks to the Fund independently. This may be connected to their cross-market view which those more closely connected to the Fund may not otherwise have access to.
Third party services providers are to be encouraged to raise potential risks with Officers to appropriate changes to the risk register can be made.
The Fund’s risk profile is dynamic. Consequently, risk management must be a continuous and developing process to ensure that the Fund is always in the best position to take full advantage of opportunities, as and when they arise, and to ensure that resources are utilised to maximum benefit.
To appropriately and effectively manage risk, it is necessary to adopt a systematic approach to its identification, analysis and control. This approach is referred to as the ‘Risk Management Process’ and provides a system that can be applied to risks at all levels within the Fund, irrespective of risks being ‘strategic’ or ‘operational’ in nature.
Risk information is recorded within the risk register, maintained by Fund Officers with oversight from the Committee and the Board.
Risk Identification
The first element of the risk management process is the identification of risks. This will link into the business planning process, where objectives and targets relating to key business activities are identified, along with associated risks. Risks associated with specific projects and partnership working should also be identified at an early stage in the planning process.
Risk identification is an ongoing process. Risks to the Fund are dynamic and can emerge at any time so their identification should not be seen as a one-off exercise.
The consideration of any reason which could undermine the smooth operation of the Fund could identify a risk. If any concern is identified this should be escalated appropriately at the earliest opportunity an in accordance with Table 1.
Table 1 – Escalating new risks
|
Person identifying risk |
Escalation point |
|
Officer below management grade |
Team leader / Pensions Manager |
|
Officer of management grade |
Head of Pensions |
|
Committee/Board member |
Committee/Board chair |
|
Committee/Board chair |
Head of Pensions |
|
Third party service provider |
Officer acting as principal liaison point |
Any risk identified should represent a specific threat or opportunity. These can be specific risks which occur as a matter of course in the usual operation of the Fund. Risks can, for ease of reference, be categorised using the headings in Table 2.
Table 2 – Risk categories
|
Category |
Definition |
Example |
|
Administration |
Risks relating to the calculation and payment of benefits or member communication |
Failure to issue Annual Benefit Statements on time |
|
Employer |
Risk relating to a failure of admitted bodies to fulfil their obligations |
Late payment of contributions |
|
Governance |
Risk to the effective operation of the Fund |
Key person risk |
|
Investment/Funding |
Risk to Fund assets |
Poor investment return |
Risk analysis
When a risk is identified and placed into the appropriate category, consideration should be given to how likely the risk is to crystallise and what impact this would have on the Fund.
Charts to help allocate risk rating are below in Tables 3.1 – 3.3. These can also be found within risk register document.
Table 3.1 - Likelihood
|
% chance of occurring |
Timeframe for occurring |
Likelihood |
Score |
|
91 – 100 |
This week |
Very High |
5 |
|
61 – 90 |
This month |
High |
4 |
|
41 – 60 |
This year |
Medium |
3 |
|
11 – 40 |
Next 5 years |
Low |
2 |
|
0 – 10 |
Next decade |
Very low |
1 |
Table 3.2 – Impact
|
|
Negligible |
Minor |
Major |
Critical |
|
Service delivery |
Handled within normal day-today routines. |
Management action required to overcome short term difficulties
|
Key targets missed.
Some services compromised. |
Prolonged interruption to core service.
Failure of key Strategic Project
|
|
Financial |
Little loss anticipated. |
Some costs incurred.
Handled within management responsibilities. |
Significant costs incurred.
Service level budgets exceeded. |
Severe costs incurred.
Statutory intervention triggered.
|
|
Reputation |
Little or no publicity.
Little staff comment.
|
Limited local publicity.
Mainly within local government community. |
Local media interest.
Comment from external inspection agencies |
National media interest seriously affecting public opinion
|
|
Reputation (continued) |
|
Causes staff concern.
|
Noticeable impact on public opinion.
|
|
|
Score |
1 |
2 |
3 |
4 |
Table 3.3 – Risk scoring
|
Likelihood |
5 |
5 |
10 |
15 |
20 |
|
|
4 |
4 |
8 |
12 |
16 |
|
|
3 |
3 |
6 |
9 |
12 |
|
|
2 |
2 |
4 |
6 |
8 |
|
|
1 |
1 |
2 |
3 |
4 |
|
|
|
1 |
2 |
3 |
4 |
|
|
|
Impact |
|
|
|
Risk Control
It is important to recognise that, by their nature, some risks will remain significant, irrespective of the control measures put in place, because they may be beyond the powers of the Fund to control.
The key to effective risk control is ensuring that a proportionate and cost effective approach is taken, having regard to the level of actual risk exposure and the benefits to be obtained. As a general rule, the cost of controlling a risk should not exceed the cost to the Fund should the risk materialise. There are various strategies which can be taken in response to an identified risk and these include:
· Terminate – avoid the risk altogether by ceasing the activity to which the risk relates. This tends to be adopted where the level of risk is extreme and where there is little opportunity to control it cost effectively. This option may often be unavailable to the Fund, especially in areas where we have a statutory duty to deliver a service;
· Treat – mitigate or control the risk. Involves implementing actions aimed at reducing either the impact or likelihood of the risk, recognising these actions should not be in excess of the level of risk exposure in terms of cost or resources;
· Tolerate – accept the risk, without any mitigations, based on the potential rewards outweighing the level of risk exposure. This approach tends to be used most often where the rewards or the costs of mitigation are especially high;
· Transfer – achieved through use of insurances or payments to third parties who are prepared to take on the risk as part of a contract. This approach is, however, unlikely to reduce any reputational risk to the Fund.
Whilst all of these strategies are available, there will be some areas of risk which the Fund will not tolerate and will always seek to reduce to an acceptable level. These areas are based on the Fund’s risk appetite which is defined as ‘the amount of risk an organisation is willing to accept’.
Where a decision is taken to mitigate or control a risk (treat), the measures taken should be appropriate and proportionate based on the likelihood, impact and potential consequence of the risk event. The nature of control risk strategies will therefore vary depending on the nature of the identified risk. Some control measures will address the likelihood element of the risk (i.e. reduce the likelihood of the risk event occurring) while others will address the impact element (i.e. once the event has occurred they will reduce the potential harm caused by the risk).
Even where it appears that an identified risk is outside the scope of meaningful control (such as the impact of severe weather events), a regularly reviewed and tested contingency plan will help reduce the detrimental impact.
Control measures will usually constitute some form of positive action and may therefore also form part of organisational service plans. By recording them in this way, targets can be set against the risk controls which can then be subject to ongoing monitoring and review as part of already established management processes.
Post Mitigation Scoring
Once mitigating actions are identified, each individual risk should be re-scored, in terms of both impact and likelihood, using the same scale as noted above (Table 3). This will result in each risk being allocated a ‘post mitigation’ risk score, and associated RAG rating.
The purpose of post mitigation scoring is to assess the effectiveness of the control measures at reducing either the impact or the likelihood element of the risk, thereby illustrating the level of remaining or ‘residual’ risk. Should this remain unacceptably high, management should consider whether further mitigating measures are required.
The Fund’s risk profile is dynamic and continually changing due to the influence of external factors and / or internal influences.
The level of risk can alter and consequently, identified risks and associated mitigations should be periodically re-assessed by Officers, the Board and the Committee to address and combat the impact of these changes. In addition to this, new risks will periodically emerge which must be identified and analysed as quickly as possible to either reduce the council’s exposure to adverse risk or enable the it to take advantage of business opportunities, as they arise.
As a minimum, the risk register should be formally reviewed and updated on a quarterly basis as part of monitoring by the Board and Committee in line with the roles and responsibilities, described above.
The appropriate management of risk is a fundamental element of the Fund’s management process and is essential if the organisation is to successfully deliver its objectives. The aim of this Framework is to provide guidance on the risk management process and to assist with the further embedding of risk management within the culture of the Fund.
This Policy was approved on 22 February 2024 by the East Sussex Pension Committee, and effective form this date. The policy will be formally reviewed at least every three years.
The latest version of this Strategy will always be available on the Fund website:
https://www.eastsussexpensionfund.org/forms-and-publications/