NIPS Annual Report and Accounts 2012-13 - Department of Justice

ANNUAL
REPORT
and Accounts
60
RISK MANAGEMENT AND INTERNAL CONTROL
Risk management forms a central element of the
department’s internal control framework. Risks are
managed at the level most able to deal with them,
with the most serious being escalated to PSMB.
During 2012-13 corporate risks were identified,
assessed, addressed and reviewed. Each directorate,
establishment, and branch has their own risk register
which is continually under review and formally
updated quarterly.
Risk management is also embedded within the
business planning process and staff are trained
and equipped to manage risk in a way appropriate
to their authority and duties. PSMB approved
an updated Risk Appetite and Risk Management
guidance document in March.
The ongoing revision of the Corporate Governance
Framework sets out the structures and arrangements
to ensure that risk and planning decisions are
appropriately identified evaluated and controlled.
This framework describes the terms of reference for
PSMB, OMB, and ARC. By doing so, it ensures that
the allocation of risk oversight is well documented
and clear at all levels of the organisation. The NIPS
Risk Management guidance document, which aligns
with the relevant DFP guidance, establishes in more
detail what is required of staff and the varying levels
of oversight responsibility throughout the Service.
Controls in place to monitor risk are set out below:
• PSMB reviews and evaluates corporate level
risk registers. In addition, the Board provides
oversight to the corporate and business planning
process by assessing and reviewing objectives
and key performance targets established for the
Service.
• ARC, which is chaired by a Non-Executive
Director, met four times during the 2012-13
financial year. The ARC reviewed Board-level
risks, as well as instances of fraud, and provided
assurance to PSMB and the Accounting Officer
throughout the year.
• Heads of Branch, and the Heads of Management
Support Services in establishments, conduct risk
management assessments in all areas of activity
and review their local risk registers on a quarterly
basis.
• Project risks are identified and managed by
respective Project or Programme Managers
and are reviewed by the relevant Project or
Programme Boards.
• South Eastern Health and Social Care Trust (SET)
has lead responsibility for prisoner healthcare. A
Regional NIPS Corporate Governance Committee,
chaired by the Director of the SET and reporting
to the Trust’s Governance Committee, has been
operated throughout the year.
• The Service has used the Gateway Review
process to assist in the management of risk on
the ongoing reform programme.
• The Service measures and reports compliance
with departmental guidance on the use of
consultants to the ARC.
• An up-to-date register is in place to record
conflicts of interest.
• The Service has a procurement policy in place.
NIPS officials attend the DOJ Procurement
Forum and the DOJ Procurement Board.
The aforementioned methods to monitor risk
have proved effective in identifying risks quickly as
they arise throughout the year. This can be seen
through the regular updating of the risk register
and the speed with which actions are put in place
to mitigate these risks. NIPS conducted a review
of its Risk Appetite which was approved by PSMB
in February. This document detailed the tolerance
for risk which NIPS has allowed in various business
areas. This includes having a high risk appetite
for policy related areas, as well as some elements
of Human Resources. In contrast, other Human
Resource elements, such as recruitment or equality,