28 City of Glasgow College Annual Report & Accounts 2020-21
management, while the Risk Management Procedure
outlines how this is delivered.
The Committee received an Internal Audit of Risk
Management in 2020 which noted that a robust risk
management framework was in place, and provided an
assurance level of "Good".
The concept of Risk Tolerance has been introduced to
all Risk Management documents, and explained in detail
within the Risk Management Guidance. This reflects the
Board's agreement to an adjusted position with regard to
risk, accepting a less risk-averse position in some areas.
The Risk Policy and Procedure has been revised to
reflect this adjustment, recognizing that in certain defined
areas, the College's Risk Tolerance is greater than in
others, with commensurate adjustment of risk appetite
in respect of some developments where there may be a
strong likelihood of tangible benefit to the College and its
stakeholders.
The most recent new strategic risks were previously
added to the College Risk Register in 2019-20 reflecting
revised strategic direction-setting by the Board, and the
changing operating environment:
• Risk 26: "Failure to achieve taught degree awarding
powers"
• Risk 27: "Failure to manage acute threats relating to
the coronavirus outbreak".
These additions brought the total of Strategic (Level
1) Risks on the College risk register to 23, which were
highlighted and discussed by the Committee, via
the individual Risk Management Action Plans. Risk
scores were adjusted throughout the session, and as a
consequence of various considerations, principally and
most recently, the coronavirus outbreak, several risks
were (at November 2020) given the highest risk rating of
RED, with several also given the highest possible score.
Risks which were given a RED rating in the course of the
session were (with key influencing factors):
• Risk 1: Failure to support successful student
outcomes (Coronavirus impact)
• Risk 6: Negative impact upon College reputation
(Fraud investigation)
• Risk 7: Failure to achieve improved business
development performance with stakeholders
(Coronavirus impact)
• Risk 15: Failure to achieve operating surplus via
control of costs and achievement of income targets.
(Coronavirus impact)
• Risk 16: Failure to maximise income via diversification.
(Coronavirus impact).
• Risk 24: Failure of compliance with the GDPR
regulations (DPO position)
• Risk 27: Failure to manage acute threats relating to the
coronavirus outbreak (various)
As the risk management actions have taken effect
over the course of the session, many risk scores have
been reduced. Among those which remain red, many
have reduced risk scores within the "red" range. This is
reflected in the following average risk score analysis:
• Average Risk Score at June 2021 = 10.7
• Average Risk Score at December 2020 = 11.3
The table below summarises the key Strategic Risks
which the College managed, and which the Audit
Committee monitored throughout 2020-21 (as approved
by the Board of Management - June 2020):