Our Observations On Local Government Risk Management Practices
Our report Our observations on local government risk management practices was presented to the House of Representatives today.
There is significant change underway, or proposed, for local government. As councils consider how to respond to this change they also need to ensure that they continue to deliver the services that their communities rely on every day. In this environment, strong risk management practices are more critical than ever. We carried out work to better understand the current state of councils’ risk management, where the challenges and issues are, and what support councils need to improve how they manage risk.
Councils provide critical services to their communities. Because there are serious consequences if these services fail, it is imperative for all councils to have a formal risk management framework in place. Some councils told us that they do not currently have a formal risk management framework. In our view, those councils should prioritise putting a formal risk management framework in place.
Councils also need to consider whether risk management is part of their organisational culture and integrated into the decisions they make. For example, the way that risk is considered by elected members, at a council’s audit and risk committee, and by management (collectively and individually), creates a culture. That culture has a significant bearing on whether a council will successfully identify and manage risk.
In our view, more could be done to support elected members as they consider the risks faced by their council, particularly how they factor this into their decision-making. Risk management should not be viewed as a separate process but integrated into all decision-making.
We encourage chief executives and elected members to consider the maturity of their existing risk management practices and prepare a clear plan for improving that maturity. We provide examples in our report to help with this. We acknowledge that implementing risk management practices takes time and resourcing. However, the consequences of not adequately managing risk are significant, and can often result in large and unexpected expenditure, service failure, and a loss of public trust and confidence.