Our recommendations

We recommend that councils:

1. prioritise putting in place a formal risk management framework if they do not have one;
2. ensure that elected members get the training and support that they need to carry out their risk management roles and responsibilities;
3. consider using more sophisticated techniques for identifying and managing risks on key programmes of work, such as quantitative risk assessments, given that the assessments that many councils make, particularly on the delivery of their capital expenditure programmes, need a high level of judgement; and
4. assess their desired level of risk management maturity and prepare a clear plan to achieve this. Regular formal reviews of their risk management practices should be carried out to inform progress and identify areas for improvement.