RISK MANAGEMENT POLICY & RISK REGISTER V1.0 2026
This policy was approved by the Committee of Management on 20th May 2026 It should be reviewed again no later than 31st March 2029
The Risk Register will be reviewed at least annually and amended according to changing risk environments and/or risk appetite.
The policy has been assessed through the organisational impact assessment process. We can, if requested, produce this document in different formats such as larger print or audioformat. We can also translate the document into various languages, as appropriate.
SCOTTISH
HOUSING
STANDARD 1
The governing body leads and directs the RSL to achieve REGULATOR good outcomes for its tenants and other service users.
STANDARDS
STANDARD 2
The RSL is open about and accountable for what it does. It understands and takes account of the needs and priorities of Its tenants, service users and stakeholders. Its primary focus is the sustainable achievement of these priorities.
STANDARD
3
The RSL manages its resources to ensure its financial well-being, while maintaining rents at a level that tenants can afford to pay.
STANDARD
4
The Governing body bases its decisions on good quality information and advice and identifies and mitigates risks to the organisation’s purpose.
STANDARD 5
The RSL conducts its affairs with honesty and integrity.
STANDARD 6
The Governing body and senior officers have the skills and knowledge they need to be effective.
1.0 INTRODUCTION
This Risk Management Policy and Risk Register is West Granton Housing Co-operative’s (WGHC) overarching risk document. It encompasses the policy, strategy and approach towards the risks facing the Co-op.
Risk management plays an integral part in the governance and management of WGHC at a strategic and operational level. It links to the delivery of the Corporate Strategy and Business Plan, and strategic objectives. WGHC needs to be pro-active and prepared in the way risks are identified and managed.
WGHC provides diverse services and operates within a small, community based geographical area. These factors emphasise the importance of risk management, business continuity planning, contingency planning and resilience to WGHC’s success.
WGHC aims to have an approach to risk that is robust and reflects best practice. In this respect, this document wherever possible uses the terminology for risk set out by the International Organisation for Standardisation (ISO) in its document ISO/IEC Guide 73 Risk Management – Vocabulary - Guidelines for use in Standards.
The aim of the Risk Management Policy is to ensure that WGHC is able to robustly demonstrate that the Governing Body (Committee of Management) more than meets its regulatory responsibilities to manage risks, implement good practice, systems and procedures and have regard to effective corporate governance ensuring that WGHC is ‘fit for purpose’ and fully compliant.
2.0 DEFINITION
Risk is the exposure to something happening that will adversely affect WGHC’s ability to meet its strategic objectives and deliver its plans successfully. Risk is defined by WGHC as:
The threat that an event or action will occur which would adversely affect the ability of WGHC to meet its business objectives, including the maintenance of its financial strength, its ability to continue to deliver safe, quality services to its member tenants and the retention of its good public image
Some risks may reflect exposures that, although harmful, will not threaten the overall health of WGHC. Other more significant risk events can be catastrophic, resulting in losses that will impair WGHC’s ability to meet its objectives and may even pose a threat to its survival.
3.0 LEGAL AND REGULATORY FRAMEWORK
The Scottish Housing Regulator (SHR) have an external interest and focus on organisations’ risk management processes, and particularly ownership and oversight of risk by the Governing Body (Committee of Management)
The SHR’s Regulatory Standards of Governance and Financial Management set out the following in relation to risk:
Scottish Housing Regulator’s Regulatory Standard No. 4
The Governing Body bases its decisions on good quality information and advice and identifies and mitigates risks to the organisation’s purpose.
Guidance Standard 4.3 - The Governing Body identifies risks that might prevent it from achieving the Association’s purpose and has effective strategies and systems for risk management and mitigation, internal control and audit.
4.0 APPROACH TO MANAGING RISK
The Strategic and Operational risks facing WGHC can come from factors both external and internal to the organisation. Analysis of the external environment in which WGHC operates and the definition of the relationship between this external environment and the organisation itself must therefore be undertaken.
The organisation’s P.E.S.T.L.E. and S.W.O.T. analyses are key tools used by WGHC to help identify the external and internal factors (threats and opportunities) that can impact the organisation. These tools help identify risks that must be addressed.
A key part of effective governance is the process through which WGHC methodically identifies and manages the risks attached to its activities. Good risk management is achieved by implementing the Risk Management Policy and associated procedures
Document Name: Created:
Version:
5.0 RISK MANAGEMENT FRAMEWORK AND ROCESS
In devising its Risk Management Policy, WGHC has utilised the risk management process and principles broadly set out within the Institute of Risk Management’s Risk Management Standard (IRM).
6.0 ROLES AND RESPONSIBILITIES
The ultimate responsibility of ensuring WGHC has a comprehensive approach to managing risk sits with the Governing Body (Committee of Management). However, responsibility for the management of risk is not restricted to any one person or group. It is the duty of the senior staff, staff and stakeholders to assist in the identification and management of risk.
Document Name: Created:
Version:
6.1 Governing Body (Committee of Management)
The Governing Body (Committee of Management) plays a governing and oversight role in risk management. It is their responsibility to ensure the Association has a robust framework in place and that risks are being appropriately identified, assessed and managed in line with organisational objectives and risk appetite. In this respect, the Governing Body (Committee of Management) will:
Establish and review Risk Appetite relevant to strategic risks.
Ensure the establishment of an effective Risk Management Policy and review the approach to risk on a regular basis.
Consider the Strategic Risk Register on a regular basis, including an annual comprehensive review.
Challenge assumptions in the Executive Management Team’s risk assessments and plans.
Ensure risk management includes legal, regulatory and ethical compliance.
Ensure that there is appropriate oversight of the risks associated with WGHC
6.2
Ensure that risk management is a key part of WGHC’s strategic planning framework.
Executive Management Team
The Executive Management Team play a central role in implementing the Risk Management Policy. They own the day-to-day responsibility for identifying, managing and monitoring risks. They will:
Implement the Risk Management Policy, ensuring it is embedded into operations.
Develop risk response processes, including contingency and business continuity programmes.
Define and manage risk responses in alignment with the organisational appetite.
Ensure timely, accurate and complete risk reporting to the Governing Body (Committee of Management)
Promote and build a risk awareness culture within WGHC, including providing training and resources to staff.
Review the effectiveness of risk responses and the Policy regularly.
Collaborate with Internal Audit to address control weaknesses and follow up on recommendations.
6.3 Internal Audit
Internal audit plays a critical role in helping WGHC develop, implement and maintain an effective risk management policy through:
Providing independent assurance on whether the policy is properly designed, effectively implemented and operating as intended.
Assessing the risk culture of WGHC
Sharing best practices and benchmarking insights to improve the policy.
Validating risk assessments and controls.
Encouraging a continuous improvement culture.
Document Name: Created:
Owner:
6.4 Individual Staff
Individual staff members play a key role in WGHC’s Risk Management policy implementation. While they may not design or oversee the system, they are directly responsible for identifying, managing, and reporting risks in their daily work. A strong risk culture depends on staff understanding and fulfilling their responsibilities. Staff should:
Understand and follow policy and procedure.
Manage operational risks in their own activities and apply appropriate controls.
Report issues promptly to allow emerging risks to be identified.
Support a risk-aware culture through participation and encouraging peers.
7.0 RISK APPETITE AND TOLERANCE
7.1 Risk Appetite
Phrase Meaning
Risk Appetite The amount of risk that the organisation is willing to seek or accept in the pursuit of its long-term strategic objectives
Risk appetite is a core consideration in WGHC’s risk management approach. As well as meeting governance standards, organisations in all sectors are increasingly being asked by regulatory key stakeholders to express clearly the extent of their willingness to take risk in order to meet their strategic objectives.
Risk appetite is the level of exposure to risk that WGHC is prepared to accept / tolerate to achieve its strategic objectives, before action is deemed necessary to reduce it. It represents a balance between the potential benefits of innovation and the threats that change invariably brings.
The approaches to setting risk appetite that WGHC has adopted to ensure a response to risk that is proportionate is as follows:
Appetite Description
Averse
Minimal
Cautious
Open
Hungry
Avoidance of risk and uncertainty is a key organisational objective.
Preference for ultra-safe options that are low risk and only have a potential for limited reward.
Preference for safe options that have a low degree of risk and may only have limited potential for reward.
Willing to consider all potential options and choose the one most likely to result in successful delivery, while also providing an acceptable level of reward and value for money.
Eager to be innovative and to choose options offering potentially higher business rewards, despite greater inherent risk(s)
Different risks have different risk appetites because each type of risk affects WGHC in different ways and not all risks carry the same consequences, likelihood, or strategic value. The level of risk WGHC is willing to accept depends on the nature of the risk, its objectives, its regulatory obligations, and its stakeholder expectations. Our risk appetite is therefore considered separately for each area.
7.2 Risk Tolerance
Phrase Meaning
Risk Tolerance
The boundaries of risk taking outside of which WGHC is not prepared to venture in the pursuit of its long-term objectives.
Risk tolerance refers to the specific limits or thresholds WGHC is willing to accept for individual risks within its broader risk appetite. Risk tolerance in the acceptable level or variation around a particular risk is expressed in quantitative terms.
Risk tolerance statements set out the boundary beyond which WGHC will not move without prior Governing Body (Committee of Management) approval. This is set out in the Association’s Scheme of Delegation and relevant policies, such as the Financial Regulations and Procurement Policy.
8.0 RISK IDENTIFICATION AND ASSESSMENT
WGHC, like all organisations, is continuously exposed to an endless number of new or changing threats / vulnerabilities / opportunities that may affect its operations and the achievement of its strategic objectives. Identification, analysis and evaluation of these threats / vulnerabilities / opportunities are the only way to understand and measure the likelihood (probability / frequency) and consequences (impact / severity) of the risk involved and decide on the appropriate measures and controls to manage them.
Strategic risk assessment is all about the identification, assessment and managing of the level of risks involved in a situation, their comparison against benchmarks of standards and determination of an acceptable level of risk. i.e., likelihood and consequence.
8.1 Risk Identification
This is the stage where threats / vulnerabilities / opportunities and WGHC risks are identified by means of our robust strategic analysis. Risk identification sets out to identify WGHC’s exposure to uncertainty. The following strategic analysis tools are used:
Performance analysis against strategic objectives
P.E.S.T.L.E. and S.W.O.T. analyses
Strategic and operational objectives (yearly review)
Key performance indicators
Strategic and operational pressure points analysis.
This high level, systematic and comprehensive corporate strategy and business planning process supports compliance with the SHR Standards. Annual business planning ensures that all significant activities within WGHC have been identified and any strategic risks flowing from these activities are identified, considered and addressed.
WGHC’s Governing Body (Committee of Management) has adopted the following classifications for its strategic risks:
8.2 Strategic & Financial Risks
Risks arising from identifying or pursuing a strategy which is poorly designed, is based on flawed or inaccurate data or fails to support the delivery of strategic plans or objectives due to changing Political, Economic, Social, Technological, Environmental and Legislative change (PESTLE)
Occurrences that will impact the effective management and control of WGHC’s finances (Financial Regulations) and the effects of external factors such as availability of private finance, cash flow, interest rate movement and any circumstances that may lead to a potential to break covenants with lenders.
8.3 Governance & Regulatory Compliance Risks
Compliance or breach of trust issues with the SHR, Health & Safety, UK GDPR, Data Protection, Freedom of Information (Scotland) Act, Employment Practices and Environmental Issues and/or risks arising from unclear plans, priorities, authorities and accountabilities, and/or ineffective or disproportionate oversight of decision-making and/or performance.
8.4
Information, Technology, Security & Property Risks
Events or occurrences that will impact the provision of our services or the control of our knowledge & data resources and communication i.e. ICT infrastructure and systems, Cyber Security, Data Breaches, Business Continuity Plans, Tenant Surveys, Stakeholder Surveys, SHR ARC data, or loss of functional office space or loss of property due to fire, flood, major landslip etc.
Risks arising from property deficiencies or poorly designed or ineffective/ inefficient safety management resulting in non-compliance and/or harm and suffering to employees, contractors, service users or the public.
8.5 Reputational & Legal Risks
Events or occurrences that will impact on WGHC’s reputation and relationship with any or all stakeholders. Risks arising from adverse events, systemic or repeated failures or poor quality, leading to damages to reputation and or destruction of trust and relations.
Risks arising from a defective transaction, a claim being made (including a defence to a claim or a counterclaim) or some other legal event occurring resulting in a liability or other loss, or a failure to take appropriate measures to meet legal requirements or to protect assets (for example, intellectual property).
8.6 Operational & Commercial Service Delivery Risks
Risks that may impact the day-to-day activities that support the delivery of our strategic objectives. Risks arising from inadequate, poorly designed, or ineffective/inefficient internal processes resulting in fraud, error, impaired customer service (quality and/or quantity of service), non-compliance and/or poor value for money.
Risks arising from poor or inadequate management of commercial partnerships, supply chains and contractual requirements, resulting in poor performance, inefficiency, poor value for money, fraud, and/or failure to meet business requirements and strategic objectives.
8.7 People Related Risks
Risks that may occur as a result of loss of key staff and/or Governing Body (Committee of Management) Members or behavioural occurrences involving member tenants
Risks arising from ineffective leadership and engagement, suboptimal culture, inappropriate behaviours, the unavailability of sufficient capacity and capability, industrial action and/or noncompliance with relevant employment legislation/HR policies resulting in negative impact on performance and/or service delivery.
8.8 Risk Description
The objective of risk description is to display the identified organisational risks in a structured format. This will be completed for each risk submitted to the Governing Body (Committee of Management) as a standard agenda item, enabling them to be aware of any new strategic risks or changes to existing strategic risks.
8.9 Risk Assessment Criteria
WGHC will carry out an assessment of each identified risk. This involves setting risk criteria to assist in assessing the likelihood (probability / frequency) of the risk occurrence and its possible consequence (impact / severity) on the organisation.
In assessing and scoring risks, WGHC will use the following criteria:
Likelihood:
the probability or frequency of the risk occurring within an agreed timeframe. This is likely to be three years at strategic level and one year at operational level.
Likelihood (Probability/Frequency)
Consequence: the impact/severity of the risk on the organisation if it was to happen.
Consequence (Impact/Severity)
1 Insignificant Easily handled within the normal course of operations, no impact on reputation, complaint unlikely, legal risk is remote. Impact Level Less Than 10%
2 Minor Slight impact on service, slight impact on reputation, complaint possible, litigation could be possible.
No impact on the strategic objectives.
3 Moderate Some service disruption, potential for adverse publicity (avoided with careful handling), complaint probable, and litigation probable. Immediate time resource reallocation with a moderate estimated cost. No impact on the strategic objectives.
4 Major Services / operations severely disrupted, adverse publicity, litigation probable, complaint probable and significant risk of failure to part of the business is possible. The risk will affect the delivery of some of strategic objectives.
5 Critical Significant ongoing concerns exist with the business and the risk is classified as critical. This risk will affect the delivery of most of our strategic objectives.
6 Catastrophic Service interrupted for a significant time, major litigation, financial costs expected. Resignation of the Governing Body (Committee of Management), breakages of financial covenants.
This risk will affect the delivery of all of our strategic objectives.
Impact Level Between 11% - 25%
Impact Level Between 26% - 50%
Impact Level Between 51% - 75%
Impact Level Between 76% - 90%
Impact Above 91%
8.10 Risk Scoring
A Risk Score will be calculated based by multiplying the Likelihood Score by the square of the Impact Score. Eash risk will be scored twice, once prior to any risk mitigations being implemented (Inherent Risk) and after mitigations are put in place (Residual Risk).
Scores are plotted in a 6x6 Risk Assessment Matrix, with the following action required:
36-80 High Unacceptable Level
4-32 Medium Acceptable Level
The impact of this risk occurring would be so severe that the related activity would need to cease immediately. Extreme risks need immediate mitigation strategies to be implemented.
This type of risk cannot be accepted. Treatment strategies aimed at reducing the risk level should be developed and implemented as soon as possible.
This level of risk can be accepted if there are no treatment strategies that can be easily and economically implemented. The risk must be regularly monitored to ensure that any chance in circumstances is detected and acted upon appropriately.
1-3 Low Acceptable Level
9.0 RISK TREATMENT
This level of risk can be accepted if there are no treatment strategies that can be easily and economically implemented. The risk must be periodically monitored however to ensure that any change in circumstances is detected and acted upon appropriately.
Risk treatment is the process of selecting and implementing measures to modify the risk. Risk treatment measures can include risk control / mitigation, risk avoidance, risk transfer, risk financing or retaining the risk.
The appropriate response to each risk will depend on its nature and the outcome of the risk assessment. The degree of attention required will be proportionate to the level of risk and the costs / benefits involved in any action to reduce the risk. Also, in deciding how to respond to risk, attention will be paid to whether it is the likelihood or impact of a risk that needs most engagement.
For each risk, the key activities designed to manage the exposure must be able to support tracking and monitoring of the nature of the risk concerned. This must include both the current (inherent) risk and our response i.e., the controls in place at the time of the ‘gross’ (inherent) assessment – and the action planned in the light of the ‘net’ (residual) assessment after the action / controls are put in place. WGHC will adopt five ways of addressing strategic risk:
Treatment Description
Tolerate
(with or without monitoring)
The exposure to risk may be tolerable without any further action being taken. Even if it is not tolerable, the ability to do anything about some risks may be limited or the cost of taking any action may be disproportionate to the potential benefit gained. In these cases, the response may be to tolerate the existing level of risk with or without monitoring. This option can be supplemented by contingency planning for handling the impacts that will arise if the risk is realised.
The greatest number of risks will be addressed in this way. This involves continuing with the activity giving rise to the risk, whilst action (control) is taken to constrain the risk to an acceptable level. Treat can be broken down into four types of control:
Preventative - To limit the possibility of an undesirable outcome being realised.
Treat
Corrective - To correct undesirable outcomes which have been realised.
Directive - To ensure a particular outcome is achieved.
Defective - To identify occasions of undesirable outcomes having been realised.
It is usually sufficient to design control to give a reasonable assurance of constraining likely impact within the “risk appetite” of WGHC.
Transfer
Terminate
Take the Opportunity
For some risks the best response may be to transfer them. This might be done by conventional insurance, or it might be done by paying a third party to take the risk in another way.
Some risks will only be treatable or confinable to acceptable levels by terminating the activities.
This option is not an alternative to those above, rather it is an option which should be considered whenever tolerating, transferring or treating a risk. You go with the flow and take the opportunity fully aware of the risks
Once the chosen action for addressing the risk has been agreed, WGHC will ensure any mitigation measures, including risk controls and risk actions, are put in place. Further mitigating actions required will have a timescale for implementation, which will be monitored via the Risk Register.
9.1 Inherent and Residual Risks
Once the appropriate actions are agreed and implemented this should mitigate / control the risks. This will allow the reporting of a comparison between the inherent risk (the risk prior to mitigating and controlling actions) and allow the Governing Body (Committee of Management) to look at the residual risk situation e.g. after the management and control actions have been put in place.
10.0 RISK REPORTING AND MONITORING
Effective risk management requires a reporting, monitoring and review structure to ensure that risks are effectively identified and assessed and that appropriate controls are in place. WGHC has put in place the following standard operating procedures to ensure compliance with good governance:
10.1 Risk Monitoring
In alignment with Section 11.1 “Lines of Defence”:
The Management Committee will monitor the “red risks”
The Executive Team will monitor the “amber risks”.
Each quarter, Committee will receive a report on the red and amber risks (see 10.2 below)
10.2
Risk Reporting
In order to carry out their role and responsibilities in relation to risk management, WGHC will:
Include consideration to the strategic risks in every report to the Governing Body (Committee of Management)
Report the Strategic Risk Register quarterly to the Governing Body (Committee of Management) for consideration of chosen risks.
Report any changes to current or emerging strategic risks out with this cycle without delay to the Governing Body (Committee of Management) for consideration.
Fully review the Strategic Risk Register annually.
Seek external validation of the Risk Management Policy and Risk Register on a 5-yearly basis.
10.3
Risk Registers
Risk registers will be reviewed in ‘real time’ by the Governing Body (Committee of Management). The following Risk Registers are in place:
WGHC Strategic Risk Register.
Operational Risk Register.
Individual Risk Registers for major projects, such as new build developments.
Document Name: Created:
