HF week's

ICSH Guidance Document: Preparing a

Risk Register/ Risk Management Plan

What is a Risk Register?

A Risk Register is a document which outlines the potential threats to the ongoing operation of an

organisation, and what mitigation measures are in place to minimise the likely occurrence of these

threats.

Why do we need a Risk Register?

The purpose of a Risk Register is to allow a housing association identify, record and attempt to

mitigate any potential risks to the organisation. It also allows them to assign ownership of that risk

to individuals within the organisation to develop and track mitigation strategies.

How do we prepare a Risk Register?

Housing Associations should assess risks that can occur at regular intervals, and these should be

discussed to ensure that proper mitigation measures are taken. In general the process for preparing

a risk register is as follows:

When the Board is satisfied that a comprehensive risk assessment has taken place, a Risk Register

should be finalised.

This contains the naming (categorisation) of the risk itself, as well as recording the likelihood of its

occurrence, possible consequences (ranked low to high), possible mitigation strategies and finally,

where the risk is deemed of material threat to the Association, assigning ownership of the risk to an

individual within the organisation.

1

• Establish the context

• What are the most likely threats to the operation of the Association?

2

• Identify the risks

• What can happen and how can it happen?

3

• Analyse the risks

• What is the likelihood and consequences of the risk occurring?

4

• Evaluate the risks

• Assess the major and minor risks for mitigation measures

5

• Treeat the risks

• Develop mitigation measures where risks can be treated

Sample headings for a risk register are contained below and each is explained in turn over the

following pages.

Category of Risk

Actual Risk

Likelihood of occurrence

Potential Impact

Mitigation measures

Person responsible

Category of Risk

Categorisation of risk involves the clustering of risks into standard, meaningful and actionable

groupings. Risks relate to both the internal structures, operations and governance of the

organisation as well as the external interaction with stakeholders and susceptibility to events

outside of the control of the organisation. Risk categories should support the initial identification

and presentation of risks. The following risk categories are an example which could be used.

 Governance and Compliance

 Strategic Advancement

 Finance & Funding

 Human Resources

 Operational Management

Actual Risk

Actual risk refers to any specific threat that could occur in an area of the organisation. These can

relate to both the internal and the external environment, and can also relate to those that can be

mitigated against and those that cannot. Depending on the size of your organisation, risks may be

identified in some or all of the following areas:

Internal External

Financial management, for example:

 Viability / liquidity

 Fraud control

 Reducing / insufficient income streams

 Income loss

 Poor cost control

 Insurances not kept up to date

Funding, for example:

 Changes in funding agreement

 Shortfalls in funding programs

Human Resources, for example:

 Succession planning

 Poor staff supervision and performance appraisal

 Staff turnover/ headhunted by competitor

 Excessive work load and poor staff morale / staff burn-out

 Difficulties in recruiting suitable staff

Regulatory environment, for example:

 Changes in regulatory framework

 Negative registration reports

 No internal systems to proactively manage all the factors that drive the performance of the organisation

Property management, for example:

 Inappropriate stock

Reputation, for example:

 Public and community perception of the Association

 Contractors fail to perform maintenance contract / Poor response time by contractors

 Stock transfer liabilities

 Asbestos

 Aging / poor quality stock

 Negative comments from press or politicians

Legislation compliance, for example:

 Privacy Act-

 Corporations Act / relevant Incorporation legislation

 Anti-discrimination / Disability Services Act

 OHS

 Meeting tax requirements

Competition, for example:

 Losing opportunities to grow

 Other providers

 Unexpected rapid growth

Corporate governance, for example:

 Lack of appropriately skilled board members

 Volunteer / board member burn out

 Board turnover

 Board fails to appraise CEO performance

 Conflict on the board

 Conflicts of interest not managed effectively

 Difficulty recruiting to the board

 Director’s insurance not kept up to date

 Policies and procedures not reviewed

 Board lacks a value based framework

Partnerships, for example:

 Risks from failed partnership arrangements

 Risk of conflict with partners

Housing management, for example:

 Poor arrears control

 Increasing proportion of tenants with complex needs

 Duty of care to tenants is not met

 Tenants / Applicants grievances and appeals

 Tenants mix unbalanced

Natural disasters, for example:

 Flood, hail storms etc

 Lacks a business continuity plan

Information technology, for example:

 IT not sufficient for expanded organisation

 IT not able to produce registration monitoring data

 IT performance date disaster recovery plan

Likelihood of Occurrence

This refers to how likely the risk is to actually materialise, and is a value judgement based on

assessing any information available regarding the risk. For example this might it include whether it

occurred in similar organisations before, or whether other organisations are planning for its

occurrence.

This can be quantified on a scale of one to five whereby one signifies that it is highly unlikely to occur

and five signifies it is very likely to occur.

1 2 3 4 5

Highly unlikely to occur

Unlikely to occur Neutral Likely to occur Very likely to occur

Potential impact

This relates to how serious the impact would be if the threat did actually occur. Risks that are

potentially more damaging to the organisation will have to be monitored more closely with

mitigation measures/ contingency plans in place for their occurrence if the risk s deemed to have a

credible likelihood of occurring.

1 2 3 4 5

Superficial damage

Limited damage Neutral Damaging Extremely damaging

Mitigation Measures

A risk rating can be developed which adds (or multiplies) the “likelihood of occurrence” and the

“potential impact”, with scores over a certain number being assigned to individuals for monitoring

and the development of mitigation measures where possible.

Mitigation measures refer to any strategies/ plans that are in place in the event of a risk to the

organisation occurring. While organisations will never be able to totally eliminate all risks relating to

its operation, it can develop certain strategies in the event of certain threats occurring, particularly if

they would be particularly damaging to the operation.

Person Responsible

This refers to the assigning of the risk to an individual (or group) within the organisation to monitor

the risk.

How often does it have to be renewed?

The plan should be updated whenever is necessary, as additional risks are identified or where

changes to the level/ likelihood of existing risks occur.

Sample Completed Risk Register Template

Category of Risk

Actual Risk Likelihood of occurrence

Potential Impact

Mitigation measures

Person responsible

Compliance and Governance

Non- compliance with requirement s under CRO, VRC, Charities Regulator

2 More severe oversight; auditing; loss of funding; reputational damage; loss of approved status.

Keep up to date with all developments; Ensure administrative requirements for compliance are dealt with in a timely manner.

Staff

Reputationa l as a result of removal from

Damage to organisations image: Loss of funds

ABC Housing depends on its good reputation to access donations, and any damage to this

Board

websites, registers etc

could severely impact this.

Strategic Advancement

Damage to public image as a result of negative publicity

Damage to public image of the organisation

Ensure that relationships with local papers etc are proactive and showcase the good work of the Association.

Fundraising decrease

Impact on services and development plans

Building of relationships with those who donate i.e. Thank You cards. Continuous development of new fund-raising initiatives.

Finance and Funding

Viability Closure of Association due to unsustainabilit y.

Periodic review of spending and auditing of accounts. Although we can be impacted by external changes in the operating environment, robust internal reporting structures mean that there is little risk of a sudden liquidity issue.

Insufficient sinking fund

Failure to carry out planned maintenance

Review and build up sinking fund over time

Operational Management

Units fall into disrepair

Higher cost of maintenance

Inspections; Caretaker working with tenants; Tenants have been encouraged to take ownership of their space and as a result they are generally kept in an excellent state of repair.

Caretaker

Damage caused by tenants

Higher maintenance cost

The main mitigation measures here are the tenant-landlord relationships in place which mean

that tenants feel part of the Association and would not intentionally damage it. We also have a repairs policy which assigns responsibility of repairs depending on their nature.

Rent arrears Loss of revenue and deterioration of landlord- tenant relations

Each tenant is issued with a rent book. Rent collection policy in place and tenants aware of their responsibilities.

Excessive void periods

Loss of revenue

Due to demand for services this is a low risk, but one that needs to be monitored given potential impact to revenue.

Human Resources

Staff turnover results in loss of skills/ knowledge

Loss of know- how effects the running of the organisation.

Keep written policies. Succession planning: younger staff taking more control and responsibility for day-to-day running of Association.