Independent expertise from MIAA enabled a local authority to recover from a critical audit rating and to embed sustainable improvements in its risk management framework. The strategic partnership ensured continuity, built internal capacity, and positioned the council for long-term resilience in managing corporate risk.

A local authority faced significant challenges in its management of organisational risk. Following a critical internal audit several years ago, the council received a “no assurance” rating, prompting urgent action to improve its systems and processes.

The Council's Projects and Performance team was tasked with transforming the risk management approach. While their efforts led to a notable improvement in the assurance rating, sustaining this progress posed a new challenge. With the team now focused on new priorities and limited capacity, there was a risk of regression in the council’s risk management maturity.

MIAA Solutions was commissioned to:

• Review and enhance the council’s approach to managing corporate risks.
• Map the council’s assurance framework using the “three lines” model – best practice approach to organisational risk management
• Integrate updated escalation processes into policy and training.
• Update the risk management policy to reflect learning and strategic developments, including risk appetite and positive risk approaches.

The Approach

MIAA Solutions supported co-delivery of key elements of the council’s risk management improvement plan. 

The partnership aimed to:

• Sustain and build upon recent improvements in risk management.
• Provide strategic advice and delivery support to the Projects and Performance Team.
• Minimise organisational risk through enhanced policy, procedures, and training

A staged, collaborative delivery model was adopted:

1. Initial Engagement: Development of a detailed project plan with the Projects and Performance Team.
2. Desktop Assessment: Evaluation of current risk management effectiveness and assurance mapping.
3. Policy Update: Integration of insights into a revised risk management policy for audit committee approval.
4. Impact Reporting: Optional summary report to capture outcomes and recommendations.

Outcomes

The Risk Management policy was fully revised to reflect best practice, audit recommendations, and strategic developments. It now includes:

• A clearly defined risk scoring methodology using a 5x5 matrix.
• Enhanced escalation and reporting thresholds aligned with the council’s governance structure.
• Integration of the “three lines of defence” model across strategic, corporate, and departmental risk registers.
• A refined approach to risk appetite, categorised by risk type and mapped to organisational priorities.
• Expanded definitions and guidance on opportunity risks, risk descriptors, and treatment strategies.
• Strengthened roles and responsibilities for staff, councillors, and partners, ensuring accountability at all levels.
• Embedded training and awareness mechanisms, supported by the Policy and Performance Team, to ensure consistent application across the organisation.

For more information about our how we can support your organisation, contact Steve Warburton, Director of Director of Delivery – Healthcare & Transformation.