Strategic Risk Register – Q2 2025/26

Ref	Strategic Risks	Risk Control / Response and Post Mitigation RAG score	RAG
5	RECONCILING POLICY, PERFORMANCE & RESOURCE (RPPR) There is ongoing uncertainty in relation to future funding allocations and the impact of national reforms, particularly across Children’s Services and Adult Social Care. Ongoing high inflation/cost of living is leading to higher demand for Council services and has increased the direct cost of providing services. Together with increased need related to demographic changes these factors create a risk of insufficient resources being available to sustain service delivery to meet the changing needs of the local community. Our revenue budget for 2025/26 includes a draw from reserves to provide a balanced budget alongside implementing savings. Total strategic reserves are projected to be £4.5m by 2029, which excludes any additional draws required to balance budgets in 2025/26 or beyond. This compares with a cumulative deficit of £70.8m by 2028/29. We are reliant on the multi-year settlement in 2026/27, fair funding review and business rates review delivering sufficient funding to meet the needs of our residents.  Additionally, there are risks and uncertainties regarding the capital programme over the current Medium Term Financial Plan period and beyond, which could impact on the ability to deliver the Council’s priorities and set a balanced budget. Funding uncertainty (including capital grants, receipts and developer contributions), inflation, supply chain issues and high interest rates could all constrain our ability to implement our Capital Strategy and increase the pressure on the revenue budget via increased borrowing costs.	We employ a robust Reconciling Policy, Performance and Resources (RPPR) process for business planning, which ensures a strategic corporate response to resource reductions, demographic change, and regional and national economic challenges; and directs resources to priority areas. We take a commissioning approach to evaluating need and we consider all methods of service delivery. We work with partner organisations to deliver services and manage demand, making best use of our collective resources. We take a 'One Council' approach to delivering our priorities and set out our targets and objectives in the Council Plan. We monitor our progress and report it quarterly. The Council reviews and updates its 20-year Capital Strategy annually as part of the RPPR process, which sets the framework in which the capital programme is planned and allows the Council to prioritise investment to support its objectives. The development and delivery of the capital programme is overseen by a Capital Strategic Asset Board (CSAB), which is a cross departmental group, who also hear from Departmental Capital Board/Sub Boards who oversee priority areas. Our plans take account of known risks and pressures, including social, economic, policy and demographic changes and financial risks. However, we continue to operate in changing and uncertain contexts. Current and forecast economic conditions continue to shape a very challenging financial outlook both for the Council itself and many of the county’s residents and businesses. Alongside this we continue to face ongoing challenges as a result of the persistent legacy of Covid, the increased cost of living and other national and international factors. We will continue to use the latest information available on these challenges to inform our business planning. On 10 June 2025, the Lead member for Resources and Climate Change approved the commissioning of CIPFA to undertake a resilience and governance review in relation to the financial challenge faced by the Council. Officers will consider the recommendations in the report and take forward actions accordingly.  We will also continually review our performance targets, priorities, service offers and financial plans, and will update these as required. As part of this we will continue to take action wherever we can to mitigate financial and service delivery pressures – making best use of new technology, investing in our workforce, seeking efficiencies, and checking that our services are effective and provide value for money. We lobby, individually and in conjunction with our networks and partners, for a sustainable funding regime for local government in general and for children’s social care and adult social care specifically, to meet the needs of the residents of East Sussex. If the funding reforms do not lead to an increase in funding for our services, we will need to consider further options, including seeking Exceptional Financial Support.	Red
12	CYBER ATTACK The National Cyber Security Centre (NCSC) has highlighted the enduring and significant threat to UK infrastructure. From ransomware attacks to AI-enabled intrusion, malicious actors are looking to maximise their disruptive and destructive efforts in an increasingly connected world. Cyber-attacks are growing more frequent, sophisticated, and damaging when they succeed. Ransomware remains the most significant cyberthreat to the UK, primarily driven by financially motivated organised crime groups. The UK’s Strategic Defence Review acknowledges daily cyber-attacks as a persistent threat and emphasises a shift towards digital warfare capabilities. Amid a rise of state aligned groups, whilst the UK is not disproportionately targeted, there is an increase in aggressive cyber activity and ongoing geopolitical challenges. There is an accelerated need to keep pace with the dynamic threat landscape. Furthermore, while AI presents huge opportunities, it is also transforming the threat landscape. Cyber criminals are adapting their business models to embrace this rapidly developing technology - using AI to increase the volume and impact of cyber attacks against citizens and organisations. Meanwhile the proliferation of advanced cyber intrusion tools is lowering the barrier for entry to criminals and states alike.	Most attacks leverage software flaws, gaps in boundary defences or social engineering-based insertion methods (such as legitimate looking emails which trigger viral payloads or impersonation of Service Desk support). These are becoming harder to identify and filter and rely on user security vigilance in tandem with technical controls. IT&D use modern security tools to assure our security posture: Monitoring network activity and identifying security threats; Keeping software up to date with regular patching regimes; Continually monitoring evolving threats and re-evaluating the ability of our toolset to provide adequate defence against them; Ongoing communication with the security industry to find the most suitable tools and systems to secure our infrastructure.  IT&D continues to invest in new tools, which use pre-emptive technology to identify threats and patterns of abnormal behaviour. Services hosted in ISO 27001 accredited Orbis Data Centres. As well as mitigations against attack, the following measures are currently in place to minimise the impact should there be a successful attack: · Behavioural analysis systems defend against hostile activity · Resilient systems enhanced with immutable backups enable quick recovery · Robust protocols for response escalation and communication	Red
22	DELIVERY OF ORACLE IMPLEMENTATION There is a risk that the overall implementation of Oracle (across phases 1 to 3) may not achieve the outcomes planned which results in: · higher delivery costs · longer timescales · a reduced quality of back-office services from a substandard technical implementation · risk of not meeting statutory or contractual requirements such as payments of Pay as You Earn (PAYE) / National Insurance (NI), pensions, suppliers and employees · general organisational issues · an inadequate control environment · lack of user buy-in and adoption due to a lack of organisational readiness impacting on core business processes · additional pressure on business as usual (BAU) capacity from high resource demands during delivery · risk to employee wellbeing from high workloads and delivery timescale Failure to implement would result in the use of an unsupported and unlicenced system (or subject to ransom charges on some level of support) as the SAP system passes its expiry date and would miss out on efficiencies that can be gained through the new system.	Phases 1 and 2 of the implementation, covering Enterprise Performance Management, Finance, Procurement, Oracle Helpdesk and Recruitment, are now live and have successfully exited the period of 'hypercare' (effectively the warranty period for the build quality of the system). These areas of Oracle functionality are now in BAU and the operational risks are therefore being managed on a day to day basis through the functional areas and through the Oracle system support team, with the support from the Oracle programme where required. This includes keeping documentation and training materials up to date, managing the Oracle quarterly updates and resolving any queries or issues that may arise, as for any other BAU type activity. Phase 3 (payroll, and employee and manager self-service) is currently in its testing and planning stage. An earliest realistically achievable go-live date for this phase is currently being considered, the delivery of which will include appropriate governance (including risk identification and mitigation, as well as audit), technical implementation, organisational readiness and plans for post go-live support. To complete the phase 3 implementation, it is necessary to ensure that sufficient programme resource is in place, and this is therefore kept under constant review. In addition, a positive ongoing working relationship with our implementation partner, Infosys, needs to be in place. The project lead and other key stakeholders therefore have regular conversations with Infosys senior staff and escalate issues where necessary. It is also necessary for the organisation to prioritise programme activity at key points in time and this is also therefore kept under constant review.	Red
15	CLIMATE Mitigation: the Council needs to play its part in meeting both the international agreement to keep the average global temperature increase under 1.5°C above pre-industrialisation levels, as well as the legally binding national target to reach ‘net zero’ by 2050. Adaptation: the Council needs to adapt relevant services to the predicted impacts of climate change in East Sussex, including more frequent and intense flooding, drought, episodes of extreme heat, and accelerated coastal erosion. If services are not sufficiently adapted to climate change this will lead to an increase in heat related deaths (particularly amongst the elderly), damage to essential infrastructure, property damage from flooding, and disruption to supply chains.	Climate change mitigation: the Council has a science-based target to reduce scope 1 and 2 carbon emissions. The focus is on buildings, as they contributed 79% of carbon emissions in 2020/21. Currently, there is not sufficient funding available for the Council to be able to keep pace with the science-based target. The target for 2025/26 is for the delivery of a further 10 capital schemes, as part of business-as-usual asset management work. In Q1 a total of 5 schemes were completed. A pipeline of additional projects is being developed. The estimated outturn is for 10 capital schemes to be completed this year. Climate change adaptation: the Council is working to ensure that all relevant Council service areas will integrate adaptation into their service planning by 2030 (within the constraint of the resources available). In addition, the Council has some direct responsibilities for county-wide climate change adaptation, for example as the Lead Local Flood Authority. The target for 2025/26 is to develop service-based guidance and tools on integrating climate adaptation and trial these with 3 services. The 3 service areas are currently being identified. The corporate Climate Emergency Board oversees progress for both mitigation and adaptation. Ultimately there is not sufficient funding available for the Council to be able to keep pace with the science-based target to halve emissions every five years. Although grant funding will be sought to mitigate against this, it is unlikely to be sufficient. The Council will continue to work on what it can to reduce emissions with the funding it has available, including working with its supply chain on Scope 3 emissions.	Red
20	PLACEMENTS FOR CHILDREN AND YOUNG PEOPLE IN OUR CARE Inability to secure sufficient high quality placements for children in our care, suitable accommodation for care experienced young people and respite provision, leading to significant financial pressure and poorer outcomes for children/young people. The risk of the failure of one or more key providers in the independent sector is an increasing concern, set against necessary regulatory tightening of profit which might further impact the market.	A number of strategies have been put in place to manage demand. Work being undertaken includes: · Delivery of the Family Hub programme - providing earlier support and intervention, Information, Advice and Guidance, Start for Life · Comprehensive Early Help offer in place - helping to manage demand at Level 3, reducing escalation. · Robust caseload management · Focus on reduction in Child Protection Plans, through delivery of Connected Coaches/Connected Families Intervention Practitioners (CFIP) interventions · Transformation - increasing partnership engagement in delivering Level 2 earlier support, Implementation of ‘Families First’ national reforms 2025/26, ‘Family Help’ teams, Multi-agency Child Protection Teams, Family Network and Kinship support. Careful consideration of transfer of Care Proceedings to Looked After Children Service after initial hearing. · Further embedding valuing care approach to ensure the right children receiving right care, maximising opportunities for step down/reunification. · Enhancing Family Network approach - Family Group Conference offered to all families pre proceedings, full exploration of kinship carers opportunities/Special Guardianship Orders. · Placement and Commissioning team - holding providers to account, utilise frameworks, scrutiny, and challenge re of all provider process.  · Participation in South East Regional Commission Cooperative - aims to improve quality/efficiency for children in care through increasing collaboration, enhancing regional commissioning, improved market shaping-building in some protections re market failure. · Strengthening marketing of foster care, increase in rates for East Sussex foster carers, partnership with Brighton & Hove and West Sussex County Council. Delivery of Mockingbird programme - improving retention of carers. · Focus on securing health contributions to Looked After Children placements - challenging ‘continuing care’ (CC) outcomes where appropriate and development of frameworks for integrated commissioning beyond CC.	Red
19	SCHOOLS AND INCLUSION, SPECIAL EDUCATIONAL NEEDS AND DISABILITIES (ISEND) For Children with Special Educational Needs. Inability to secure statutory provision due to lack of availability of specialist placement within the county and increasing demand for placements in this sector. This would put the Council at risk of judicial review and/or negative Local Government Ombudsman judgements for failing to meet our duties within the Children and Families Act 2014, with associated financial penalties and reputational damage.	A number of strategies have been put in place to mitigate this risk. Work being undertaken includes: · Effective use of forecasting data to pre-empt issues. · Work with statutory partners to develop contingency plans. · Work with the market to increase provision where needed. · Expanding internal interim offer for children.	Red
1	ROADS Extreme weather events over recent years, including the last winter, have caused significant damage to many of the county’s roads, adding to the backlog of maintenance in the County Council’s Asset Plan: and increasing the risk to the Council’s ability to stem the rate of deterioration and maintain road condition	The changing climate is now influencing the rate of road deterioration, with more extreme events such as warmer wetter winters; and drier summers punctuated by unseasonal heavy downpours (drying and shrinking the substructure of roads). Additional funding over the last few years has helped maintain road condition, however, the latest condition and funding modelling showed the potential for continued deterioration over the next 10 years. The highway’s maintenance budget for 2025/26 only includes government grant. In previous years we have increased spend through borrowing. We no longer have the flexibility to borrow because of the broader revenue pressure on Council services. This means the level of funding available is below the £25 million needed each year to keep our roads in a steady condition. This funding shortfall, alongside rising costs, presents a considerable challenge in maintaining current standards across the whole network. As a result, we are now taking a more targeted approach to managing network condition - prioritising routes of highest importance to ensure we maintain a safe and resilient core network. This means making difficult decisions about where limited resources can have the greatest impact. In East Sussex, we are focusing on A and B roads and key non-principal routes that form part of our resilient network, because they are vital for emergency services, public transport, and the local economy. Mitigations include encouraging road users to report potholes so we can intervene as soon as possible in accordance with our policies; closely managing the operational performance of the highway contractor; and lobbying Government for additional investment as, without it, it will be increasingly difficult to manage the risks of further decline. New technologies and materials are being trialled to improve efficiency and resilience. Our new Asset Management System, introduced in September 2025, is enhancing how we plan and prioritise maintenance, using better data to model funding needs and target investment for greatest impact. It also strengthens transparency and accountability in decision-making. We are also future-proofing assets, such as street lighting, to adapt to changing technologies and deliver long-term value.	Red
4	HEALTH Failure to secure maximum value from partnership working with the National Health Service (NHS). If not achieved, there will be impact on social care, public health and health outcomes and increased social care operational and cost pressures, as well as shared Integrated Care System objectives for jointly managing patient flow through our System. An increase in activity and complexity in the presentation of patients through our acute hospital sites, has resulted in an increase in the NCTR (No Criteria to Reside) numbers and presents a system risk in respect of adequate patient flow. Integrated Care Board (ICB) operating costs and programme funding will need to reduce by 50% by Q3 2025/26 as per a national mandate.  For NHS Sussex this means a reduction of 53% which presents a risk to the way ESCC works with the NHS to jointly commission services locally and get the best value out of the collective resources available for our population, including potential transfers of current Continuing Healthcare, SEND and safeguarding functions, all of which would need primary legislation to enact (and would therefore be post cost reductions). It could also have implications for the Sussex Integrated Care System (ICS) which would impact on alignment with the Mayoral County Combined Authority Devolution plans.	The system is working collaboratively to improve hospital discharge and reduce delayed stays for patients with complex care needs. Funded until Quarter 2 of 2025/26 (with reduced funding after March 2025), initiatives include keeping patients active in hospital, creating care coordination hubs, deploying two Social Work Teams for ‘discharge to recover and assess’ beds, and commissioning a scheme to support self-funded care. These efforts have led to a sustained decrease in the number of patients with no clinical need to remain in hospital (NCTR), though continued success depends on adequate community bed capacity and suitable post-hospital support for increasingly complex needs. The Additional Discharge Funding is now fully integrated into the Better Care Fund pooled budget (no longer ring-fenced). It covers Home First pathways and Discharge to Assess beds, with capacity balanced through a multi-agency approach. A small portion of the fund is reserved to maintain flexibility and support patient flow, especially over winter. Collaborative work is underway to create multi-disciplinary neighbourhood teams serving populations of 30,000–50,000, building on joint leadership in each Integrated Community Team (ICT) area. These ‘one-team’ approaches aim to deliver more proactive, coordinated care for people with complex needs and reduce unplanned hospital admissions, especially over winter. Participation in the National Neighbourhood Health Implementation Programme (NNHIP) — starting in Hastings and Rother — will accelerate local ICT and proactive care plans, supporting the shift from hospital-based to community-focused care and more sustainable use of existing resources overall. NHS England has now agreed that NHS Sussex will merge with NHS Surrey to form a single Integrated Care Board (ICB) from 1 April 2026, reducing operational costs by 50% in line with national NHS reforms. The new ICB will serve 3 million people (including 1.7 million in Sussex). To prepare, the two ICBs will begin formally clustering on 1 October 2025, sharing a Chair and Chief Executive from 15 October, with a single Board to be appointed later. The four upper tier Local Authorities across Surrey and Sussex have agreed to be represented collectively on the new single clustered ICB Board through four senior roles (Chief Executive, DASC, DCS, and DPH). ESCC also continues to work with ICB and local NHS partners to adapt joint planning and commissioning, aiming to preserve collaboration and integration despite changes and capacity pressures in the NHS system, and to deliver the best outcomes within available resources. In a further reform the Government’s 10-Year Health Plan (July 2025) announced proposals to abolish Integrated Care Partnerships (ICPs) required under the current Health and Care Act 2022 - in Sussex this is the Sussex Health and Care Assembly. To maintain local focus amid a move to a larger Surrey and Sussex planning area, the four LAs have proposed keeping the Sussex Assembly on an informal, non-statutory basis to support population health and align with the future Sussex CMA footprint.	Red
23	Local Government Reorganisation and Devolution Both the proposed creation of a new Mayoral County Combined Authority for Sussex and the proposed transition from a two tier local authority arrangement to a unitary government model for East Sussex will have a significant effect on our workforce. These are likely to lead to additional workloads for staff over the next few years. The timescales for implementation are challenging and will place considerable additional pressures on teams. This could have result in resources being diverted from the ongoing delivery of services and a consequential deterioration in service delivery.	Through our RPPR process we will continue to review the resources required to support Devolution and Local Government Reorganisation and will lobby Government for additional funding to help support the significant additional workload this will place on the Council. We will also continue our work on supporting staff through change and will ensure all staff are aware of the full range of support available to them. Additional mitigations will be implemented as the potential impact on both the Council and our local area becomes clearer.	Amber
9	WORKFORCE An inability to attract and retain the high calibre staff needed in key services and roles could lead to a reduction in the expertise and capacity required to deliver statutory services to our residents, including to prevent harm to children, young people and vulnerable adults at the required level and standards, impacting on the achievement of the Council’s strategic objectives.	A number of strategies have been put in place to support our recruitment and retention aims. Work being undertaken includes: · ongoing use of apprenticeships, traineeships, intern arrangements and more flexible work arrangements etc as a way of bringing in new talent to the Council. · working with Children’s residential and community services to support their use of apprenticeships to gain the Ofsted required qualification · ongoing review of our new recruitment website ‘East Sussex County Council Careers’ to ensure the content remains engaging and interesting and attracts individuals to apply for our jobs. · continued delivery of mentoring to young people in care by Adecco (the Councils Agency supplier) as part of their social value offer. · engagement with employees at ESCC who are under 25 to get feedback on what attracted them to the Council as an employer; and to begin establishing a forum for young people to highlight any issues, and to attract candidates from a younger demographic to the Council. · continued delivery of inclusive recruitment training to managers · ongoing promotion of guidance to managers on making reasonable adjustments for disabled candidates. · guidance on the use of volunteers as a route into the workplace is being developed. The intention is for such opportunities to support people who are out of work to come back into the workplace through gaining confidence and experience of work · a review of the current leadership development offer following the delivery of our two leadership development programmes: ‘Ladder to Leadership’ and ‘Head of Service Masterclasses’.	Amber
18	DATA BREACH A breach of security/confidentiality leading to destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes. A personal data breach is a security incident that has affected the confidentiality, integrity or availability of personal data regardless of whether information has been accessed, altered or disclosed via electronic or manual means. While AI presents huge opportunities, if used inappropriately the risk of data breach is heightened. Risks to individuals, reputational damage, fines from the Information Commissioner’s Officer (ICO), compensation claims.	Policy and guidance procedures in place to support practice. Data Protection Officer (DPO), Caldicott Guardians and Information Governance Officers monitor breach reporting and put in place mechanisms to minimise recurrence. Staff training to develop awareness. E-learning and policy delivery mechanism expanded to enhance skills and increase awareness of responsibilities under General Data Protection Regulation legislation. Technical security measures operated by Information Technology and Digital (IT&D), including access control and segregation of duties.	Amber
6	LOCAL ECONOMIC GROWTH The devolution of powers, responsibilities, functions and funding through a Mayoral Combined County Authority (MCCA) for Sussex will lead to significant changes, impacts and opportunities for East Sussex County Council (ESCC) in enabling and supporting the local economic growth for our residents, businesses and visitors. Possible consequences if the devolution is not managed successfully include: · Ineffective structures and mechanisms to position and make the case for local economic growth in East Sussex · The county unable to access future investment opportunities if East Sussex does not influence strategy development and adoption to determine strategic priorities at MCCA level · Lack of development of a credible pipeline of investments that will seek to maximise the levels of funding · Lack of funding secured from MCCA for major programmes, which then limits our ability to raise GVA and productivity in the area · Loss of an effective ‘business voice’ through the current local economic growth board (Team East Sussex) and its various subgroups able to provide intelligence and set the strategic direction for the county.	In July 2025 the Government approved the Sussex and Brighton MCCA, to cover East Sussex, West Sussex and Brighton and Hove, to be established in 2026. At this stage the details are unclear as to how the devolved functions will operate between the new MCCA and existing upper tier authorities (and then subsequently the unitary authorities, as a result of Local Government Reorganisation from May 2027). Our risk control/response will be adjusted as information becomes available to consider the wider impact / opportunity this will have on the local economy through the development at a Sussex wide level of jointly agreed strategies and the resulting funded and commissioned programmes. As part of our initial response to mitigate these risks we are undertaking the following: · New Local Transport Plan 4 to 2050 is in place and we are developing a series of accompanying transport modal strategies, alongside investment plans to support the implementation of the devolved MCCA transport powers. · We and strategic partners are developing an investment plan in 2025 to accompany the ‘East Sussex Prosperity to 2050’ economic growth strategy to articulate our investment propositions and asks to the new devolved MCCA and Government, whilst also addressing the Governments emerging Industrial Strategy and Sector Plans.  · We run the East Sussex Growth Hub services and Government have confirmed funding 2025/26 and in future years will provide a multi-year funding settlement for 2026-28. · We ensure the business voice continues to be heard through Team East Sussex, our local strategic advisory economic growth board for the county, which continues to meet on a quarterly basis. The Council is in a good position to mitigate risks on employment support and skills as it will be contributing to the development of the Get Sussex Working Plan by September 2025 and the Local Skills Improvement Plan by March 2026, alongside delivering major Government funded programmes for Connect to Work, Skills Bootcamps and Careers hub to name a few.	Amber
21	Annual Care Act reviews and Deprivation of Liberty Safeguarding (DoLS) assessments Demand exceeding capacity for annual Care Act reviews and Deprivation of Liberty Safeguarding (DoLS) assessments	These are known issues for virtually all local authorities with social care responsibilities as this activity falls within our duties under the Care Act 2014 and Mental Capacity Act 2005. As of Q2 2025/26: We are meeting our target for adult reviews (outturn is 5 days against a target of 6 or fewer days) and carer reviews (outturn is -1 day against a target of 6 or fewer days, meaning reviews started on average one day before their proposed start date). We are also meeting our target for the number of people with a Deprivation of Liberty Safeguards (DoLS) episode awaiting allocation of a Best Interest Assessor (outturn is 200 people against a target for 650 or fewer people). Mitigations and actions: We are continuing to increase the number of reviews completed year-on-year to help meet increasing demand, and to prioritise reviews according to people’s needs. As of July 2025, 69/7% of adult Care Act reviews were completed against a target of 66.6%. We have oversight of performance at all levels of the Council to ensure visibility, accountability and grip. Weekly and monthly reporting is sent to Operational Managers at all levels, and then scrutinised by the Waiting Times Steering Group and the Improvement and Assurance Board on a regular basis. Since October, we have piloted the delegation portal with our strategic partner Care for the Carers, making it easier and quicker for them to process carer reviews. This pilot is now BAU and will be monitored by commissioners and operational services. Young carers reviews are undertaken by Imago Community, ensuring a timely assessment and review for this cohort.	Amber