Risk management

1. Roles and responsibilities

• The Board has responsibility for the strategic direction of VisitScotland, ensuring that it fulfils the aims and objectives set by the Scottish Ministers. The Board approves risk management arrangements and considers the risk implications of Board decisions. It is informed on risk by the Audit & Risk Committee.
• The Audit & Risk Committee (ARC) is a sub-committee of the Board which advises the Board on the strategic processes for risk, control and governance. The processes include the compilation of a risk register and the effectiveness of our management of risk. The Committee monitors effectiveness through reviews, challenge, and internal audit reports on the systems of internal control.
• The Chief Executive, as Accountable Officer, is responsible for maintaining a sound system of internal control and ensuring a system of risk management is embedded in the organisation. This system is designed to inform decisions on financial and operational planning and to assist in achieving objectives and budgets.
• The Leadership Group comprising of the Chief Executive, Directors, and other Senior Management, has overall responsibility for the operation of risk management and ensuring regular reviews are carried out. Directors are responsible for promoting risk awareness within their operations and ensuring risk management is incorporated at the concept stage of projects. Risk is integrated into the planning and management process and is a standing item for bi-weekly meetings of the Leadership Group.
• The Director of Corporate Services provides leadership and advice on all aspects of corporate governance, audit and risk management to the Board and Leadership Group and is VisitScotland’s Senior Information Risk Manager (SIRO).
• The Risk Officer is VisitScotland’s risk champion and promotes risk management within the culture of the organisation. The Risk Officer is responsible for the Risk Strategy and Framework and building awareness of it within the organisation, maintaining the Corporate Risk Register, chairing the Risk Management Committee, leading reviews of risk, and drafting a Risk Report for each Audit & Risk Committee meeting. The Risk Officer will also consult with colleagues on a regular basis to identify any new or changed risks, attend project Steering Groups to provide risk management support, and have oversight of all project risk registers.
• The Risk Management Committee (RMC) comprises of senior managers from all areas of the business who meet in advance of each Audit & Risk Committee meeting to monitor and review all risk registers for and oversee risk management arrangements within VisitScotland.
• Risk Owners are those who ‘own’ a risk for the organisation. These will normally be Directors but can be Heads of Departments or Project Managers.
• Mitigating Action Owners are those members of staff who have responsibility to deliver on specific actions which will mitigate risk.
• Project Managers are responsible for the creation of a project risk register, and management of the risks aligned with their project.
• ABC Owners will prepare risk registers for those ABC related risks not covered in the Corporate Register as part of their annual operations plans, and report on progress. They will involve their staff in minimising the effect of risks in their area of operation.
• Internal Auditors will review, challenge and report on the adequacy and effectiveness of the system of internal control including audit of the risk management and reporting process.
• External Auditors also review and report on the system of internal control along with other corporate governance matters including the effectiveness of the risk policy and strategy.

3. Risk classification

VisitScotland has classified the type of risk as either External or Internal with sub-categories according to their nature.

External risks are those over which we have limited/no control but are to do with the nature and purpose of the organisation, its ability to achieve its mission, the environment it works in, its competitors, the stakeholders’ needs it seeks to satisfy, its response to opportunities and threats, its vulnerability to political and economic shifts, or the solidity of its reputation and standing.

Internal risks are those which we can control and are to do with the day to day operation of the business in areas like marketing, communications, managing relationships, events, retailing, technology, human resources, facilities, procurement and finance.

Categories for risks are shown in the table below - they can be external or internal:

Nature of risk types are shown in the table below:

5. Risk register

VisitScotland has a Corporate Risk Register covering the main strategic, operational, horizon and project risks identified by the Board and Management. These are split between "External" risks over which we have little control, e.g. foreign exchange rate fluctuations, flu pandemic, terrorism, natural disasters, political decisions, and "Internal" risks which we can influence, e.g. adverse media commentary, lack of commitment from the trade, lack of funding, core IT system failure, loss of staff and morale, damage to offices etc.

The Risk Register shows the current and planned mitigating actions and controls for each key risk, the person responsible and an assessment of the likelihood and impact of the risk occurring. All risks must be reported through this template, however, whilst project risks can be detailed and controlled on a separate risk register template, a project overview and current scoring must be summarised in the Corporate Risk Register.

7. Additional project risk registers

All major new initiatives and significant projects will undergo a risk assessment process which will generate a project-specific risk register to be owned and maintained by the Project Manager and reviewed by the Risk Officer and the projects’ Steering Group. This forms part of the VisitScotland standard project management methodology as overseen by the Portfolio Office.

The Risk Officer will provide advice and guidance on the risk process to Project Managers which should include a brainstorming session of risks with the project team and other interested parties in order to identify all the risks. The initial project risk register is also reported to the Audit & Risk Committee by the Project Manager with any updates as considered appropriate.

9. Options for managing risks (mitigation)

Risk management is not simply about identifying risks and then avoiding them. It is about managing those risks in the most efficient and effective manner. External and internal risks are identified, objectively assessed, scored using quantitative methods and, where this is the appropriate response, actively managed. The most common forms of dealing with or responding to risk are:

Terminate the risk - do something differently thereby removing the risk completely. Care should be taken that any alternative approach does not create bigger risks.

Treat the risk - this is where action is taken to reduce the likelihood or impact of the risk. The key is that any action must be cost effective against the size and impact of the risk.

Contingency planning - where the impact or likelihood of the risk cannot be reduced to an acceptable level (or even when it can) then contingency plans should be devised to ensure business continuity and recovery after events that cannot be controlled. Contingency plans should as a minimum be considered for all risks with expected high impact or high likelihood. Contingency plans should always be tested.

Transfer the risk - this is where the risk’s financial impact or the responsibility for managing it is given to someone other than VisitScotland. This can usually be achieved by contracting out the activity or through insurance or penalty clauses.

Tolerating the risk - this response to a risk is really the response of last resort. Tolerating the risk involves accepting a risk above our acceptable level without reducing it, probably because nothing can be done to reduce it a reasonable cost.

11. Risk proximity

Risk proximity means how close we are, in terms of time, to a risk potentially occurring. Assessing and applying the proximity of a risk allows for risk prioritisation. We need to assess when the risk is likely to occur so that we can respond to it appropriately. Risk proximity is used to ensure that focus on risks is balanced with a greater emphasis on those risks that are likely to occur in the short term.

The below table outlines fixed proximity categories that should be applied to risks within a risk register.

It is important that ongoing monitoring of a risks’ proximity is carried out when undertaking review of the risk register, in the eventuality of a change to the risk horizon.