From mountain to sea

Risk Management and

Business Continuity Strategy
2
Aberdeenshire Council’s Risk Management and Business Continuity Strategy
Foreword
by Jim Savege
The Council recognises risk management
and business continuity as an integral part
of its Corporate Governance arrangements.
We recognise that there are risks involved
in everything we do, and that the Council
has a duty to manage these risks in a
structured manner at both a strategic and
operational level. In doing so, the Council will
better achieve its objectives and enhance
the quality of the services it provides.
We are therefore committed to working
together as one Council in adopting
best practice for the identification,
evaluation and cost-effective control of
risk to ensure that they are eliminated
or mitigated to an acceptable level.
Elected members and the Strategic
Leadership Team are committed to the
necessary allocation of resources to
enable effective management of risk
throughout Aberdeenshire Council.
Employees will be supported to ensure
they have a clear understanding of the
nature of the risks faced and their role
in eliminating or mitigating the risks
associated with their area of work.
Business continuity and emergency
planning are key elements in ensuring
that the Council continues to provide 3
critical services in times of adversity. We
will continue to ensure that support is
Aberdeenshire Council’s Risk Management and Business Continuity Strategy
provided to all Services to ensure that
effective contingency plans and processes
are in place to deal with disruptions to
identified critical services or systems.
Your continued commitment to embedding
our risk management and business
continuity processes is an essential
element of Aberdeenshire becoming
the best area and best council.
Aberdeenshire Council’s Risk Management and Business Continuity Strategy
Our Risk Management
& Business Continuity
Strategy
Aberdeenshire Council is an organisation
committed to continual improvement and
development through both innovation
and a willingness to change and adapt.
The Council firmly believes that risk
requires to be properly managed rather than
avoided and that effective risk management
will not stifle creativity and innovation.
In managing risk the Council will look to
4 exploit opportunities as well as guarding
against threats and ensure that decisions
are taken with full regard and understanding
of the possible impact upon the Council’s
reputation, assets, financial resources,
employees and the wider community.
The Council recognises its responsibilities
under the Civil Contingencies Act 2004 and
the need to provide resilient services and
to support the community of Aberdeenshire
in the event of an emergency arising.
To support this strategy we will:
 Work in partnership with our
internal and external colleagues
to identify and mitigate the
risks we face as a Council
 Continually review and update our
risk registers through employee
and partner involvement
 Manage risk in a way that supports
the delivery of excellent customer
service in support of the Council’s
vision and strategic objectives.
 Work with all Services to ensure
that business continuity plans
are in place to support the critical
activities of the Council
 Engage with our employees,
partner organisations and the wider
Aberdeenshire community to develop
emergency plans and procedures
proportionate to the risks faced
 Improve the communication links
that support what we do.
Key Elements
and Themes
Our strategy for risk management and
business continuity has six key elements
within three main themes, all of which
have important links between them:
Risk Management
1. Continued development
of our risk registers
5
2. Embedding risk

Aberdeenshire Council’s Risk Management and Business Continuity Strategy

management
3. Ensuring appropriate
risks are insured

Business Continuity
4. Ensuring that we have business
continuity plans in place
5. Maintaining a business continuity
management system

Emergency Planning
6. Preparing for and responding
to emergencies
 1. Continued development of our
Aberdeenshire Council’s Risk Management and Business Continuity Strategy
risk registers - a culture of
continuous improvement
We operate in an environment which
is continually changing and this has
an impact on the risks that we face
both strategically and operationally.
This strategy will ensure we:
 Identify, assess and manage
strategic and operational risks
in a consistent manner.
 Maintain processes for managing
project and partnership risk
 Review, challenge and update
risks on a continuing basis
6 measures put in place
2. Embedding risk management
- risk is a key element in our
processes not an add on.
Risk management is about protecting
our organisation, our employees and the
residents of Aberdeenshire. We need to
identify the risks associated with a particular
course of action at an early stage and
ensure that the required controls are “built
in” rather than “added on” at a later stage.
This strategy will ensure that:
 Appropriate guidance and training is
 Developed, and made available
 Risks are identified early,
and proportionate control
 The likelihood of financial loss,
service disruption and reputational
damage is mitigated effectively
3. Ensuring appropriate risks
are insured - protecting the
Council against financial loss.
The Council recognises that risk cannot be
eliminated entirely, therefore arrangements
require to be in place to ensure that the
Council is protected against financial loss.
This strategy will ensure that:
 Appropriate levels of
insurance are put in place
 Some elements of risk
are self-insured
 Reporting mechanisms are in place,
including analysis of loss trends
4) Ensuring that we have business
continuity plans in place
– the ability to deliver critical
activities in times of adversity 7
There are many unplanned events
Aberdeenshire Council’s Risk Management and Business Continuity Strategy
which can occur which pose a risk to our
organisation and which can cause major
disruptions to services we provide. These
unplanned events could be external
(extreme weather conditions/ natural
disasters) or internal (systems failure).
This strategy will ensure that:
 Critical activities and
systems are identified
 Effective business continuity
plans are in place
 Our business continuity plans
are widely communicated
and understood
 5. Developing a business
Aberdeenshire Council’s Risk Management and Business Continuity Strategy
continuity management system
- ensuring that our plans
are kept ‘fit for purpose’
The Council is constantly evolving and
changing, and our business continuity
plans must evolve to reflect this.
This strategy will ensure that:
 A process is in place to review,
test and update our plans
 Plans remain both adequate
and effective
 The delivery of critical activities
is not compromised
8 emergency response and
6. Preparing for Emergencies
- ensuring that we have
plans in place to respond to
a major civil emergency
As a Council we are committed to working
with our colleagues in other public services
to ensure that integrated plans are in place
that will allow an effective response to
major incidents occurring in Aberdeenshire
and the wider Grampian area.
This strategy will help us:
 Ensure that effective contingency
plans and processes are in place to
deal with identified threats and risks
 Test and review our
business continuity plans
 Ensure that our emergency
and business continuity plans
are ‘fit for purpose’ and that
an effective framework is in
place to manage incidents
 Support services, partner
organisations and event organisers
to ensure that appropriate Event
Safety Plans are in place
Monitoring & Reviewing
our Risk Management
and Business Continuity
Strategy
The Risk Management, Business Continuity
and Emergency Planning Strategies and
Framework are currently subject to review.
The Director of Business Services
will be reporting the outcome of the
Risk Management Review to Audit
Committee in July 2021 and will be
seeking approval to consult with Area and 9
Policy Committees on a Revised Risk
Management Strategy and Framework.

Aberdeenshire Council’s Risk Management and Business Continuity Strategy

Policy Committees will also be informed
of the outcome of the Risk Management
Review by means of a Bulletin Report.
The aim is to submit a report to
Audit Committee in September 2021
seeking approval for the Revised Risk
Management Strategy and Framework.
 Governance
Aberdeenshire Council’s Risk Management and Business Continuity Strategy

Council Committee(s)
Leader of the Council

Strategic Leadership Team

Jim Savege

Corporate Risk Management Steering Group

Chair: Ritchie Johnson, Director of Business Services
(Appointed Director for Health & Safety)
Service Representatives (Head of Service) • Trade Unions
• Subgroup Chairs • Health, Safety & Wellbeing and Risk (Advisors to the Group)
Remit is to:
1. Steer all aspects of risk in line with the Council’s Policies and Strategies (e.g.
Risk Management & Business Continuity, Health, Safety and Wellbeing)
2. Consider legislative changes (within the scope of the subgroups)
3. Oversee the progress of the subgroups ensure implementation of the Council Strategies, developed
10 from the identification of a base line through auditing, self-assessment and statistical information
4. Challenge adequacy and effectiveness of implementation and monitoring of corporate policies
and procedures to ensure compliance with legislation, corporate strategies and the completion
of action plans
5. Report progress to the Strategic Leadership Team and Council Committee(s)

Sub-Groups to Implement Risk Management Review Action Plan

To be established following approval of the Risk Management
Strategy and Framework, which is currently subject to review

Service Management or Partnership Management/Leadership Teams

Service Health and Safety/Risk Committees or Consultation Groups

Supporting respective Service or Partnership Management/Leadership Teams
 Risk Management & Business Continuity Framework

11

Aberdeenshire Council’s Risk Management and Business Continuity Strategy

Aberdeenshire Council’s Risk Management and Business Continuity Strategy

www.aberdeenshire.gov.uk
12

Version Description Date

1.0 Created 2017
1.1 Update 11-May-21

Produced by Aberdeenshire Council • GDT24320 • May 2021